@teleporthq/teleport-plugin-next-workflows 0.44.8 → 0.44.10

package/__tests__/_helpers/load-server-runtime.ts

@@ -5,9 +5,10 @@ import { generateServerRuntimeCode } from '../../src/server-runtime-code'
 /**
  * The generated `utils/workflows/server-runtime.js` exactly as a route loads
  * it: the shared runtime utilities plus the server-only signed hand-off,
- * internal-call token and trusted base URL.
+ * internal-call token and trusted base URL. `modules` answers the packages a
+ * project may have installed (`@vercel/functions`); any other is missing.
  */
-export function loadServerRuntime(): Record<string, any> {
+export function loadServerRuntime(modules: Record<string, unknown> = {}): Record<string, any> {
   const shared: { exports: Record<string, unknown> } = { exports: {} }
   // eslint-disable-next-line @typescript-eslint/no-implied-eval
   new Function('module', 'exports', generateSharedRuntimeUtilsCode())(shared, shared.exports)
@@ -19,6 +20,9 @@ export function loadServerRuntime(): Record<string, any> {
     if (id === './runtime-utils') {
       return shared.exports
     }
+    if (id in modules) {
+      return modules[id]
+    }
     throw new Error(`Unexpected require in server runtime: ${id}`)
   }
   // eslint-disable-next-line @typescript-eslint/no-implied-eval

package/__tests__/_helpers/run-account-delete-route.ts

@@ -0,0 +1,140 @@
+import * as crypto from 'crypto'
+import {
+  AccountDeleteRouteOptions,
+  generateAccountDeleteRoute,
+} from '../../src/account-delete-route-generator'
+
+/**
+ * Runs the generated `pages/api/account/delete-current.js` for a signed-in
+ * visitor against a stubbed `pg` client: the user row and the
+ * `information_schema` column lists come from `tables`, every statement is
+ * recorded, and the project's own-table discovery answers no tables.
+ */
+
+export interface DeleteRouteRun {
+  status: number
+  body: any
+  statements: Array<{ sql: string; params: unknown[] }>
+}
+
+export interface DeleteRouteSetup {
+  userRow: Record<string, unknown>
+  /** Platform table name -> its columns. A table not listed does not exist. */
+  tables: Record<string, string[]>
+  requestBody?: unknown
+  env?: Record<string, string>
+  options?: AccountDeleteRouteOptions
+  /** Further modules the route may require, by the name it requires them with. */
+  modules?: Record<string, unknown>
+}
+
+// bcryptjs is not installed in this repository; this stand-in keeps bcrypt's
+// contract (compare a password against the hash it produced) deterministically.
+export const fakeBcrypt = {
+  hashSync: (text: string): string =>
+    '$2a$12$' + crypto.createHash('sha256').update(text).digest('hex').slice(0, 53),
+  compareSync: (text: string, hash: string): boolean => fakeBcrypt.hashSync(text) === hash,
+}
+
+/** What the sign-up stores for a password: bcrypt over SHA-256(password + pepper), base64. */
+export const storedHashOf = (password: string, pepper = ''): string =>
+  fakeBcrypt.hashSync(
+    crypto
+      .createHash('sha256')
+      .update(password + pepper)
+      .digest('base64')
+  )
+
+const USER_ROW_SQL = /^SELECT \* FROM \S+ WHERE id = \$1$/
+const COLUMNS_OF_ONE_TABLE =
+  "SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = $1"
+
+export const runAccountDeleteRoute = async (setup: DeleteRouteSetup): Promise<DeleteRouteRun> => {
+  const run: DeleteRouteRun = { status: 0, body: undefined, statements: [] }
+
+  class Client {
+    public async connect() {
+      return
+    }
+    public async query(sql: string, params: unknown[] = []) {
+      run.statements.push({ sql, params })
+      if (USER_ROW_SQL.test(sql)) {
+        return { rows: [setup.userRow] }
+      }
+      if (sql === COLUMNS_OF_ONE_TABLE) {
+        const columns = setup.tables[String(params[0])]
+        return { rows: (columns || []).map((column_name) => ({ column_name })) }
+      }
+      return { rows: [] }
+    }
+    public async end() {
+      return
+    }
+  }
+
+  const fakeRequire = (name: string): unknown => {
+    if (name === 'pg') {
+      return { Client }
+    }
+    if (name === 'bcryptjs') {
+      return fakeBcrypt
+    }
+    if (name === 'crypto') {
+      return crypto
+    }
+    if (name === 'next-auth/jwt') {
+      return { getToken: async () => ({ id: setup.userRow.id }) }
+    }
+    if (name.endsWith('/utils/email/email-locale')) {
+      return { pickLocalizedTemplate: (base: unknown) => base, resolveRequestLocale: () => 'en' }
+    }
+    if (setup.modules && name in setup.modules) {
+      return setup.modules[name]
+    }
+    throw new Error(`unexpected require: ${name}`)
+  }
+  const moduleObj: { exports: any } = { exports: {} }
+  // tslint:disable-next-line:function-constructor
+  new Function(
+    'require',
+    'module',
+    'exports',
+    'process',
+    'console',
+    generateAccountDeleteRoute({ authUsersTableName: 'users', ...(setup.options || {}) })
+  )(
+    fakeRequire,
+    moduleObj,
+    moduleObj.exports,
+    {
+      env: {
+        TELEPORT_DB_CONNECTION_STRING: 'postgresql://user:pw@db.test/site',
+        NEXTAUTH_SECRET: 'secret',
+        ...(setup.env || {}),
+      },
+    },
+    { error: () => undefined, warn: () => undefined, info: () => undefined }
+  )
+  const handler = moduleObj.exports as (req: unknown, res: unknown) => Promise<unknown>
+  const res = {
+    status(code: number) {
+      run.status = code
+      return res
+    },
+    json(body: unknown) {
+      run.body = body
+      return res
+    },
+  }
+  await handler(
+    {
+      method: 'POST',
+      headers: {},
+      ...(setup.requestBody === undefined ? {} : { body: setup.requestBody }),
+    },
+    res
+  )
+  return run
+}
+
+export const sqlOf = (run: DeleteRouteRun): string[] => run.statements.map((s) => s.sql)

package/__tests__/account-delete-current-password.test.ts

@@ -0,0 +1,73 @@
+import { loadHandler, HandlerFn } from './_helpers/load-handler'
+import { bindWorkflowUtils } from './_helpers/bind-workflow-utils'
+
+/**
+ * The delete-account handler posts to the site's delete route. A template that
+ * asks for the password passes what the visitor typed, and the route checks it
+ * before deleting anything; a template without a password posts an empty body,
+ * as the store's own Delete account always has.
+ */
+
+const installBrowser = () => {
+  const element = { textContent: '', setAttribute: jest.fn() }
+  ;(globalThis as any).window = {
+    location: { href: '' },
+    localStorage: { setItem: jest.fn(), removeItem: jest.fn() },
+    dispatchEvent: jest.fn(),
+    setTimeout: (fn: () => void) => fn(),
+    document: { createElement: () => element, body: { appendChild: jest.fn() } },
+    __teleportNextAuth: { signOut: jest.fn(async () => undefined) },
+  }
+  ;(globalThis as any).CustomEvent = class {
+    constructor(public type: string, public init?: unknown) {}
+  }
+}
+
+describe('account-delete-current sends the password it is given', () => {
+  let unbindWorkflowUtils: () => void
+  let fetchMock: jest.Mock
+
+  beforeAll(() => {
+    unbindWorkflowUtils = bindWorkflowUtils()
+  })
+
+  afterAll(() => {
+    unbindWorkflowUtils()
+  })
+
+  beforeEach(() => {
+    installBrowser()
+    fetchMock = jest.fn(async () => ({ ok: true, json: async () => ({ success: true }) }))
+    ;(globalThis as any).fetch = fetchMock
+  })
+
+  afterEach(() => {
+    delete (globalThis as any).window
+    delete (globalThis as any).CustomEvent
+    delete (globalThis as any).fetch
+  })
+
+  const postedBody = () => JSON.parse(fetchMock.mock.calls[0][1].body)
+
+  it('posts the typed password to the delete route', async () => {
+    const handler: HandlerFn = loadHandler('account-delete-current')
+    await handler({ password: 'typed-secret' }, {})
+    expect(fetchMock.mock.calls[0][0]).toBe('/api/account/delete-current')
+    expect(postedBody()).toEqual({ password: 'typed-secret' })
+  })
+
+  it('posts an empty body when the template asks for no password', async () => {
+    const handler: HandlerFn = loadHandler('account-delete-current')
+    await handler({ redirectTo: '/' }, {})
+    expect(postedBody()).toEqual({})
+  })
+
+  it("throws the route's message when the password is refused", async () => {
+    fetchMock.mockImplementationOnce(async () => ({
+      ok: false,
+      json: async () => ({ error: 'Incorrect password' }),
+    }))
+    const handler: HandlerFn = loadHandler('account-delete-current')
+    await expect(handler({ password: 'wrong' }, {})).rejects.toThrow('Incorrect password')
+  })
+})

package/__tests__/account-delete-password-check.test.ts

@@ -0,0 +1,113 @@
+import { runAccountDeleteRoute, sqlOf, storedHashOf } from './_helpers/run-account-delete-route'
+
+/**
+ * The editor's delete-account form asks the visitor for their password. The
+ * site's delete route checks a password the request carries against the
+ * account's stored hash, the way sign-in does, and deletes nothing when it is
+ * not theirs. A request without a password deletes as before.
+ */
+
+const USER_ID = 'user-1'
+const PASSWORD = 'correct horse battery staple'
+
+const userRow = (password: string | null = storedHashOf(PASSWORD)) => ({
+  id: USER_ID,
+  email: 'ana@example.com',
+  name: 'Ana',
+  password,
+})
+
+const TABLES = {
+  users: ['id', 'email', 'name', 'password'],
+  teleport_cart: ['id', 'user_id'],
+}
+
+const deletedTheAccount = (sql: string[]) =>
+  sql.includes('DELETE FROM users WHERE id = $1') && sql.includes('COMMIT')
+
+const changedAnything = (sql: string[]) =>
+  sql.some((statement) => /^(BEGIN|UPDATE|DELETE|INSERT)/.test(statement))
+
+describe('deleting an account with a password', () => {
+  it('deletes the account when the password is the account’s own', async () => {
+    const run = await runAccountDeleteRoute({
+      userRow: userRow(),
+      tables: TABLES,
+      requestBody: { password: PASSWORD },
+    })
+
+    expect(run.status).toBe(200)
+    expect(deletedTheAccount(sqlOf(run))).toBe(true)
+  })
+
+  it('answers 403 and changes nothing when the password is not', async () => {
+    const run = await runAccountDeleteRoute({
+      userRow: userRow(),
+      tables: TABLES,
+      requestBody: { password: 'not it' },
+    })
+
+    expect(run.status).toBe(403)
+    expect(run.body).toEqual({ error: 'Incorrect password' })
+    expect(changedAnything(sqlOf(run))).toBe(false)
+  })
+
+  it('reads a body that arrives as a JSON string', async () => {
+    const refused = await runAccountDeleteRoute({
+      userRow: userRow(),
+      tables: TABLES,
+      requestBody: JSON.stringify({ password: 'not it' }),
+    })
+    expect(refused.status).toBe(403)
+
+    const accepted = await runAccountDeleteRoute({
+      userRow: userRow(),
+      tables: TABLES,
+      requestBody: JSON.stringify({ password: PASSWORD }),
+    })
+    expect(accepted.status).toBe(200)
+  })
+
+  it('checks with the project’s pepper, as sign-in does', async () => {
+    const peppered = userRow(storedHashOf(PASSWORD, 'pepper-1'))
+    const withPepper = await runAccountDeleteRoute({
+      userRow: peppered,
+      tables: TABLES,
+      requestBody: { password: PASSWORD },
+      env: { AUTH_PEPPER: 'pepper-1' },
+    })
+    expect(withPepper.status).toBe(200)
+
+    const withoutPepper = await runAccountDeleteRoute({
+      userRow: peppered,
+      tables: TABLES,
+      requestBody: { password: PASSWORD },
+    })
+    expect(withoutPepper.status).toBe(403)
+  })
+
+  it('refuses any password for an account that has none stored (a social sign-in)', async () => {
+    const run = await runAccountDeleteRoute({
+      userRow: userRow(null),
+      tables: TABLES,
+      requestBody: { password: '' },
+    })
+
+    expect(run.status).toBe(403)
+    expect(changedAnything(sqlOf(run))).toBe(false)
+  })
+})
+
+describe('deleting an account without a password', () => {
+  it.each([
+    ['no body', undefined],
+    ['an empty object', {}],
+    ['the node’s "{}" string', '{}'],
+    ['a null password', { password: null }],
+  ])('deletes as before with %s', async (_label, requestBody) => {
+    const run = await runAccountDeleteRoute({ userRow: userRow(), tables: TABLES, requestBody })
+
+    expect(run.status).toBe(200)
+    expect(deletedTheAccount(sqlOf(run))).toBe(true)
+  })
+})

package/__tests__/account-delete-visitor-details.test.ts

@@ -0,0 +1,206 @@
+import { DeleteRouteRun, runAccountDeleteRoute, sqlOf } from './_helpers/run-account-delete-route'
+
+/**
+ * Closing an account takes the visitor's details out of the site's own records
+ * too: the activity log no longer names them, a download no longer says who
+ * fetched it from where, a gift card they bought or received keeps working
+ * under the anonymised address, and the emails the site sent them stay on
+ * record without the address, the body or the values they were filled with.
+ * The invoices already issued to them are the exception: an invoice must keep
+ * naming its buyer. A table the site does not have is left alone.
+ */
+
+const USER_ID = 'user-1'
+const USER_EMAIL = 'Ana@Example.com'
+const ANONYMISED = `deleted-user-${USER_ID}@deleted.invalid`
+
+const userRow = { id: USER_ID, email: USER_EMAIL, name: 'Ana' }
+
+const TABLES = {
+  users: ['id', 'email', 'name', 'password'],
+  teleport_events: ['id', 'event_type', 'dedupe_key', 'order_id', 'payload', 'actor'],
+  teleport_downloads: [
+    'id',
+    'order_id',
+    'order_item_id',
+    'product_file_id',
+    'user_id',
+    'ip_address',
+  ],
+  teleport_gift_cards: ['id', 'code', 'balance', 'recipient_email', 'purchaser_email'],
+  teleport_sent_emails: ['id', 'recipient_email', 'recipients', 'body_html', 'payload', 'subject'],
+}
+
+const updatesOf = (run: DeleteRouteRun, table: string) =>
+  run.statements.filter((statement) => statement.sql.indexOf('UPDATE ' + table + ' ') === 0)
+
+describe('deleting an account removes the visitor from the site’s records', () => {
+  let run: DeleteRouteRun
+
+  beforeAll(async () => {
+    run = await runAccountDeleteRoute({ userRow, tables: TABLES })
+  })
+
+  it('still deletes the account', () => {
+    expect(run.status).toBe(200)
+    expect(sqlOf(run)).toContain('DELETE FROM users WHERE id = $1')
+  })
+
+  it('blanks the activity log’s actor where it is their email', () => {
+    expect(updatesOf(run, 'teleport_events')).toEqual([
+      {
+        sql: 'UPDATE teleport_events SET actor = $1 WHERE lower(actor) = lower($2)',
+        params: ['', USER_EMAIL],
+      },
+    ])
+  })
+
+  it('clears who downloaded and from where, keeping the download counted', () => {
+    expect(updatesOf(run, 'teleport_downloads')).toEqual([
+      {
+        sql: 'UPDATE teleport_downloads SET user_id = NULL, ip_address = NULL WHERE user_id = $1',
+        params: [USER_ID],
+      },
+    ])
+  })
+
+  it('moves the gift cards they bought or received to the anonymised address', () => {
+    expect(updatesOf(run, 'teleport_gift_cards')).toEqual([
+      {
+        sql: 'UPDATE teleport_gift_cards SET purchaser_email = $1 WHERE lower(purchaser_email) = lower($2)',
+        params: [ANONYMISED, USER_EMAIL],
+      },
+      {
+        sql: 'UPDATE teleport_gift_cards SET recipient_email = $1 WHERE lower(recipient_email) = lower($2)',
+        params: [ANONYMISED, USER_EMAIL],
+      },
+    ])
+  })
+
+  it('keeps the emails sent to them on record without address, body or values', () => {
+    expect(updatesOf(run, 'teleport_sent_emails')).toEqual([
+      {
+        sql: "UPDATE teleport_sent_emails SET recipient_email = '', recipients = NULL, body_html = '', payload = NULL WHERE lower(recipient_email) = lower($1)",
+        params: [USER_EMAIL],
+      },
+    ])
+  })
+
+  it('does all of it inside the deletion’s transaction', () => {
+    const sql = sqlOf(run)
+    const begin = sql.indexOf('BEGIN')
+    const commit = sql.indexOf('COMMIT')
+    for (const table of Object.keys(TABLES).filter((name) => name !== 'users')) {
+      const at = sql.findIndex((statement) => statement.indexOf('UPDATE ' + table + ' ') === 0)
+      expect(at).toBeGreaterThan(begin)
+      expect(at).toBeLessThan(commit)
+    }
+  })
+})
+
+describe('the invoices already issued to them', () => {
+  const SHOP_TABLES = {
+    users: TABLES.users,
+    teleport_orders: ['id', 'user_id', 'customer_email', 'billing_email', 'invoice_pdf_url'],
+    teleport_invoices: [
+      'id',
+      'order_id',
+      'customer_name',
+      'customer_address',
+      'customer_city',
+      'customer_country',
+      'customer_vat',
+      'customer_email',
+      'pdf_url',
+    ],
+    teleport_invoice_items: ['id', 'invoice_id', 'description', 'amount'],
+  }
+  let run: DeleteRouteRun
+
+  beforeAll(async () => {
+    run = await runAccountDeleteRoute({ userRow, tables: SHOP_TABLES })
+  })
+
+  it('keep the buyer’s name, address, tax number and email', () => {
+    expect(run.status).toBe(200)
+    expect(sqlOf(run).filter((sql) => sql.indexOf('teleport_invoice') !== -1)).toEqual([])
+  })
+
+  it('while their orders still drop the account and its email', () => {
+    expect(updatesOf(run, 'teleport_orders')).toEqual([
+      {
+        sql: 'UPDATE teleport_orders SET user_id = NULL, billing_email = $2, customer_email = $3 WHERE user_id = $1',
+        params: [USER_ID, ANONYMISED, ANONYMISED],
+      },
+    ])
+  })
+})
+
+describe('a site without those tables', () => {
+  it('deletes the account and touches none of them', async () => {
+    const run = await runAccountDeleteRoute({
+      userRow,
+      tables: { users: TABLES.users },
+    })
+
+    expect(run.status).toBe(200)
+    expect(sqlOf(run).filter((sql) => sql.indexOf('UPDATE') === 0)).toEqual([])
+  })
+
+  it('leaves a table alone when it lacks the column', async () => {
+    const run = await runAccountDeleteRoute({
+      userRow,
+      tables: { users: TABLES.users, teleport_events: ['id', 'event_type'] },
+    })
+
+    expect(updatesOf(run, 'teleport_events')).toEqual([])
+  })
+})
+
+describe('the farewell email', () => {
+  it('is recorded without the visitor’s address, body or values', async () => {
+    const recorded: any[] = []
+    const sent: any[] = []
+    class Resend {
+      public emails = {
+        send: async (message: unknown) => {
+          sent.push(message)
+          return {}
+        },
+      }
+    }
+    const run = await runAccountDeleteRoute({
+      userRow,
+      tables: TABLES,
+      env: { RESEND_KEY: 're_test' },
+      options: {
+        emailProvider: 'resend',
+        fromEmail: 'hello@shop.test',
+        emailSecretEnvName: 'RESEND_KEY',
+        emailBodyHtml: '<p>Goodbye {{userName}}</p>',
+      },
+      modules: {
+        resend: { Resend },
+        '../../../utils/email/sent-email-log': {
+          recordSentEmail: (entry: unknown) => recorded.push(entry),
+          settleSentEmailLog: async () => undefined,
+        },
+      },
+    })
+
+    expect(run.status).toBe(200)
+    // The visitor still gets it…
+    expect(sent).toHaveLength(1)
+    expect(sent[0].to).toEqual([USER_EMAIL])
+    expect(sent[0].html).toBe('<p>Goodbye Ana</p>')
+    // …and the ledger keeps only that it was sent.
+    expect(recorded).toHaveLength(1)
+    expect(recorded[0]).toMatchObject({
+      emailType: 'account-deleted',
+      to: ANONYMISED,
+      html: '',
+      payload: null,
+      status: 'sent',
+    })
+  })
+})

package/__tests__/ai-error-contract.test.ts

@@ -54,6 +54,16 @@ describe('isFatalNodeResult — error contract normalization', () => {
     expect(utils.isFatalNodeResult({ success: false })).toBeTruthy()
   })
 
+  it('lets a result that says success: true through, even one carrying an error note', () => {
+    expect(
+      utils.isFatalNodeResult({
+        id: 're-1',
+        success: true,
+        error: 'refused for blocked@lumen.test (only the owner)',
+      })
+    ).toBeFalsy()
+  })
+
   it('does not flag successful results', () => {
     expect(utils.isFatalNodeResult({ result: 'ok' })).toBeFalsy()
     expect(utils.isFatalNodeResult({ error: false })).toBeFalsy()