@teleporthq/teleport-plugin-next-workflows 0.44.8 → 0.44.9

package/__tests__/auth-password-change-ends-sessions.test.ts

@@ -0,0 +1,178 @@
+import * as crypto from 'crypto'
+import { UIDLAuthentication } from '@teleporthq/teleport-types'
+import { generateAuthOptionsFile, USER_REFRESH_INTERVAL_MS } from '../src/auth-generator'
+
+/**
+ * A password change, a password reset included, signs the account out of every
+ * session opened before it. The session token carries a short fingerprint of
+ * the stored password hash (never the hash); the periodic refresh compares it
+ * with the account's current hash and ends a session whose fingerprint no
+ * longer matches. Sign-in with the new password works as before. Run on the
+ * EMITTED auth options.
+ */
+
+const EMAIL = 'ada@example.com'
+const FINGERPRINT = '__passwordFingerprint'
+
+const auth = {
+  enabled: true,
+  dataSourceId: 'ds-1',
+  dataSourceType: 'postgresql',
+  passwordAuthEnabled: true,
+  providers: [],
+  roles: ['user'],
+  tables: {
+    users: [
+      { name: 'id', type: 'UUID', nullable: false, isPrimaryKey: true },
+      { name: 'name', type: 'VARCHAR(255)', nullable: true },
+      { name: 'email', type: 'VARCHAR(255)', nullable: true },
+      { name: 'password', type: 'TEXT', nullable: true },
+      { name: 'role', type: 'VARCHAR(255)', nullable: false },
+    ],
+  },
+  pageProtection: {},
+  folderProtection: {},
+  authPages: {},
+  callbackBaseUrl: '/api/auth/callback',
+  envKeys: {},
+  customUserProperties: [],
+} as unknown as UIDLAuthentication
+
+// The stand-in for utils/auth/hash-password.js: a "hash" the test can name.
+const hashOf = (password: string) => `hash:${password}`
+
+const bootAuthOptions = () => {
+  const store: { row: Record<string, unknown> | null; failReads: boolean } = {
+    row: { id: 'u-1', email: EMAIL, name: 'Ada', role: 'user', password: hashOf('old secret') },
+    failReads: false,
+  }
+  class FakeClient {
+    public async connect(): Promise<void> {
+      return undefined
+    }
+    public async query(): Promise<{ rows: Array<Record<string, unknown>> }> {
+      if (store.failReads) {
+        throw new Error('connection refused')
+      }
+      return { rows: store.row ? [{ ...store.row }] : [] }
+    }
+    public async end(): Promise<void> {
+      return undefined
+    }
+  }
+  const fakeRequire = (name: string): unknown => {
+    if (name === 'pg') {
+      return { Client: FakeClient }
+    }
+    if (name === 'crypto') {
+      return crypto
+    }
+    if (name === './hash-password') {
+      return { verifyPassword: (password: string, hash: string) => hash === hashOf(password) }
+    }
+    if (name === './db-health') {
+      return { classifyAuthInfrastructureError: () => 'unknown' }
+    }
+    const provider = (config: unknown) => config
+    ;(provider as any).default = provider
+    return provider
+  }
+  const moduleObject: { exports: any } = { exports: {} }
+  // tslint:disable-next-line:function-constructor
+  new Function('require', 'module', 'exports', 'process', generateAuthOptionsFile(auth, null))(
+    fakeRequire,
+    moduleObject,
+    moduleObject.exports,
+    {
+      env: { TELEPORT_DB_CONNECTION_STRING: 'postgres://stub', NEXTAUTH_SECRET: 'secret-1' },
+    }
+  )
+  const authOptions = moduleObject.exports
+  const authorize = (password: string) =>
+    authOptions.providers[0].authorize({ email: EMAIL, password })
+  const signIn = async (password: string) =>
+    authOptions.callbacks.jwt({ token: {}, user: await authorize(password) })
+  // The refresh /api/auth/session runs once the token's interval has passed.
+  const refresh = (token: Record<string, unknown>) =>
+    authOptions.callbacks.jwt({
+      token: { ...token, __userRefreshedAt: Date.now() - USER_REFRESH_INTERVAL_MS - 1 },
+    })
+  return { authOptions, store, authorize, signIn, refresh }
+}
+
+describe('a password change ends the sessions opened before it', () => {
+  it('keeps a session whose password has not changed', async () => {
+    const site = bootAuthOptions()
+    const token = await site.signIn('old secret')
+
+    expect(typeof token[FINGERPRINT]).toBe('string')
+    const refreshed = await site.refresh(token)
+    expect(refreshed.email).toBe(EMAIL)
+    expect(refreshed[FINGERPRINT]).toBe(token[FINGERPRINT])
+  })
+
+  it('refuses the older session at its next refresh once the hash changed', async () => {
+    const site = bootAuthOptions()
+    const before = await site.signIn('old secret')
+
+    site.store.row!.password = hashOf('new secret')
+
+    await expect(site.refresh(before)).rejects.toThrow()
+    // A profile save refreshes at once, and is refused the same way.
+    await expect(
+      site.authOptions.callbacks.jwt({ token: { ...before }, trigger: 'update' })
+    ).rejects.toThrow()
+  })
+
+  it('signs in with the new password, and keeps that session', async () => {
+    const site = bootAuthOptions()
+    site.store.row!.password = hashOf('new secret')
+
+    await expect(site.authorize('old secret')).rejects.toThrow('InvalidCredentials')
+    const after = await site.signIn('new secret')
+    const refreshed = await site.refresh(after)
+    expect(refreshed.email).toBe(EMAIL)
+  })
+
+  it('fingerprints a session that has none at its first refresh, then holds it to that', async () => {
+    const site = bootAuthOptions()
+    const legacy = { id: 'u-1', email: EMAIL, name: 'Ada', role: 'user' }
+
+    const adopted = await site.refresh(legacy)
+    expect(typeof adopted[FINGERPRINT]).toBe('string')
+
+    site.store.row!.password = hashOf('new secret')
+    await expect(site.refresh(adopted)).rejects.toThrow()
+  })
+
+  it('never carries the hash, and never shows the fingerprint on session.user', async () => {
+    const site = bootAuthOptions()
+    const token = await site.signIn('old secret')
+
+    expect(JSON.stringify(token)).not.toContain(hashOf('old secret'))
+    const session = await site.authOptions.callbacks.session({
+      session: { user: {}, expires: '' },
+      token,
+    })
+    expect(session.user.email).toBe(EMAIL)
+    expect(FINGERPRINT in session.user).toBe(false)
+  })
+
+  it('keeps the session when the database cannot be read', async () => {
+    const site = bootAuthOptions()
+    const token = await site.signIn('old secret')
+
+    site.store.failReads = true
+    const kept = await site.refresh(token)
+    expect(kept.email).toBe(EMAIL)
+  })
+
+  it('reads nothing within the refresh interval', async () => {
+    const site = bootAuthOptions()
+    const token = await site.refresh(await site.signIn('old secret'))
+
+    site.store.row!.password = hashOf('new secret')
+    const within = await site.authOptions.callbacks.jwt({ token: { ...token } })
+    expect(within.email).toBe(EMAIL)
+  })
+})

package/__tests__/data-api-invalid-body.test.ts

@@ -0,0 +1,110 @@
+/* tslint:disable:function-constructor */
+import { generateDataAPIRoute } from '../src/data-api-route-generator'
+
+/**
+ * The generated `/api/data/<ds>/<op>` route answers a request whose body is
+ * empty or is not a JSON object with 400, without opening a database
+ * connection; it used to fail with a 500 parsing it.
+ */
+
+const SECRET = 'server-secret'
+
+interface RouteResult {
+  status: number
+  body: any
+  connections: number
+  queries: string[]
+}
+
+function bootRoute() {
+  const queries: string[] = []
+  let connections = 0
+  class FakeClient {
+    public async connect(): Promise<void> {
+      connections++
+    }
+    public async end(): Promise<void> {
+      return
+    }
+    public async query(sql: string): Promise<{ rows: any[]; rowCount: number }> {
+      queries.push(sql)
+      if (/^SELECT COUNT/i.test(sql)) {
+        return { rows: [{ count: '0' }], rowCount: 1 }
+      }
+      return { rows: [], rowCount: 0 }
+    }
+  }
+  const moduleObj: { exports: any } = { exports: {} }
+  const fakeRequire = (name: string): any => {
+    if (name === 'pg') {
+      return { Client: FakeClient }
+    }
+    if (name === 'next-auth/jwt') {
+      return { getToken: async () => null }
+    }
+    throw new Error('unexpected require: ' + name)
+  }
+  new Function('require', 'module', 'exports', 'process', 'console', generateDataAPIRoute())(
+    fakeRequire,
+    moduleObj,
+    moduleObj.exports,
+    { env: { NEXTAUTH_SECRET: SECRET, TELEPORT_DB_CONNECTION_STRING: 'postgresql://x' } },
+    { error: () => undefined, warn: () => undefined, log: () => undefined }
+  )
+  const handler = moduleObj.exports
+  return async (body: unknown): Promise<RouteResult> => {
+    queries.length = 0
+    connections = 0
+    const result: RouteResult = { status: 0, body: null, connections: 0, queries: [] }
+    const res = {
+      status(statusCode: number) {
+        result.status = statusCode
+        return this
+      },
+      json(payload: any) {
+        result.body = payload
+        return this
+      },
+    }
+    await handler(
+      {
+        method: 'POST',
+        query: { params: ['ds-1', 'select'] },
+        headers: { 'x-internal-data-secret': SECRET },
+        body,
+      },
+      res
+    )
+    result.connections = connections
+    result.queries = queries.slice()
+    return result
+  }
+}
+
+describe('data API — a request body that is not a JSON object', () => {
+  const run = bootRoute()
+
+  it.each([
+    ['an empty body', ''],
+    ['text that is not JSON', 'tableName=products'],
+    ['truncated JSON', '{"tableName": "prod'],
+    ['no body', undefined],
+    ['a JSON null', 'null'],
+    ['a JSON array', '[{"tableName":"products"}]'],
+    ['a parsed array', [{ tableName: 'products' }]],
+  ])('answers 400 to %s, without touching the database', async (_label, body) => {
+    const result = await run(body)
+
+    expect(result.status).toBe(400)
+    expect(result.body).toEqual({ error: 'Invalid request body. Expected a JSON object.' })
+    expect(result.connections).toBe(0)
+    expect(result.queries).toEqual([])
+  })
+
+  it('still reads a JSON object sent as a string', async () => {
+    const result = await run(JSON.stringify({ tableName: 'products' }))
+
+    expect(result.status).toBe(200)
+    expect(result.queries.some((sql) => /FROM "?products"?/i.test(sql))).toBe(true)
+  })
+})

package/__tests__/data-node-not-awaited.test.ts

@@ -18,8 +18,9 @@ import type { WorkflowSegment } from '../src/types'
 //   1. the workflow does not wait for the query;
 //   2. the node's context entry is `null` — never a partial or stale value;
 //   3. a failure cannot abort the workflow (it is logged, not thrown);
-//   4. the server route STILL settles the query before it responds, because a
-//      serverless function may be frozen the instant it replies;
+//   4. the server route STILL lands the query, because a serverless function
+//      may be frozen the instant it replies: on Vercel through waitUntil, after
+//      the reply; elsewhere before it (pending-work-after-reply.test.ts);
 //   5. the client dispatches an all-fire-and-forget SEGMENT without awaiting the
 //      round trip, which is where the latency the visitor feels actually goes.
 
@@ -448,9 +449,9 @@ describe('generated server segment route', () => {
     expect(route).toContain('context[node.id] = null;')
   })
 
-  it('settles in-flight queries BEFORE responding (the platform can freeze us)', () => {
-    expect(route).toContain('await utils.settlePendingNodePromises(context);')
-    const settleAt = route.indexOf('await utils.settlePendingNodePromises(context);')
+  it('hands in-flight queries off (or settles them) BEFORE responding (the platform can freeze us)', () => {
+    expect(route).toContain('await utils.handOffPendingNodePromises(context);')
+    const settleAt = route.indexOf('await utils.handOffPendingNodePromises(context);')
     const respondAt = route.indexOf(
       'res.status(200).json({ success: true, results: utils.segmentReply(SEGMENT_CONFIG, context, __incomingSnapshot) });'
     )
@@ -464,7 +465,7 @@ describe('generated server segment route', () => {
 
   it('drains even when the segment throws', () => {
     expect(route).toContain(
-      'if (__wfContext) { await utils.settlePendingNodePromises(__wfContext); }'
+      'if (__wfContext) { await utils.handOffPendingNodePromises(__wfContext); }'
     )
   })
 

package/__tests__/invoice-payment-line.test.ts

@@ -0,0 +1,68 @@
+import type { UIDLInvoiceSettings } from '@teleporthq/teleport-types'
+import { generatePdfGeneratorCode } from '../src/invoice/pdf-generator-code'
+import { evaluateEmittedModule } from './_helpers/load-invoice-route'
+
+/**
+ * The invoice's payment line says how the order was paid in words, with the
+ * provider that took the money ("Card (Stripe)", "Cash on delivery", "Paid
+ * online" for a booking), and the provider's payment id as "Ref. pi_…". It
+ * used to print the stored ids ("card", "cash_on_delivery", "pi_…") as they
+ * are. Run on the EMITTED renderer.
+ */
+
+const SETTINGS = {
+  invoicePrefix: 'INV-',
+  defaultTaxRate: 0,
+  companyDetails: {},
+  template: { document: null as unknown },
+  tables: { invoicesTable: 'teleport_invoices', invoiceItemsTable: 'teleport_invoice_items' },
+  emailDelivery: { enabled: false },
+} as unknown as UIDLInvoiceSettings
+
+interface PdfGeneratorModule {
+  buildInvoiceDataScope: (invoiceData: Record<string, unknown>) => {
+    invoiceData: { Payment: Record<string, string> }
+  }
+}
+
+const renderer = evaluateEmittedModule<PdfGeneratorModule>(
+  generatePdfGeneratorCode(SETTINGS, null, null),
+  require
+)
+
+const paymentOf = (invoice: Record<string, unknown>) =>
+  renderer.buildInvoiceDataScope({ items: [], ...invoice }).invoiceData.Payment
+
+describe('the invoice payment line', () => {
+  it.each([
+    ['card', 'stripe', 'Card (Stripe)'],
+    ['card', '', 'Card'],
+    ['online', '', 'Paid online'],
+    ['online', 'mollie', 'Paid online (Mollie)'],
+    ['cash_on_delivery', '', 'Cash on delivery'],
+    ['cash_on_delivery', 'cash_on_delivery', 'Cash on delivery'],
+    ['cod', '', 'Cash on delivery'],
+    ['cash', '', 'Cash'],
+    ['store_pickup', '', 'Paid at pickup'],
+    ['gift_card', '', 'Gift card'],
+    ['bank_transfer', '', 'Bank transfer'],
+    ['paypal', '', 'Paid online (PayPal)'],
+    ['stripe', '', 'Paid online (Stripe)'],
+    ['', 'coingate', 'Paid online (CoinGate)'],
+    ['apple_pay', '', 'Apple pay'],
+    ['', '', ''],
+  ])('prints method %j with provider %j as %j', (method, provider, label) => {
+    expect(paymentOf({ paymentMethod: method, paymentProvider: provider }).method).toBe(label)
+  })
+
+  it('names the provider in words', () => {
+    expect(paymentOf({ paymentProvider: 'paypal' }).provider).toBe('PayPal')
+    expect(paymentOf({ paymentProvider: '' }).provider).toBe('')
+  })
+
+  it('prints the payment id as a reference, and nothing without one', () => {
+    expect(paymentOf({ paymentIntentId: 'pi_3Nabc' }).intentId).toBe('Ref. pi_3Nabc')
+    expect(paymentOf({ paymentIntentId: '' }).intentId).toBe('')
+    expect(paymentOf({}).intentId).toBe('')
+  })
+})

package/__tests__/invoice-tender.test.ts

@@ -387,6 +387,122 @@ describe('invoice PDF renderer — vouchers and the gift-card tender', () => {
     expect(voucherHtml).not.toContain('Amount due:')
   })
 
+  describe('an order paid partly by gift card and the rest by card', () => {
+    // 96.00 in all: 40.00 from the gift card, 56.00 charged to the buyer's card
+    // or collected by the courier.
+    const splitTender: Row = {
+      ...giftCardInvoice,
+      giftCardAmount: 40,
+      amountDue: 56,
+    }
+    const paidSplitTender: Row = { ...splitTender, status: 'paid', paidAt: '2026-10-20' }
+    // Cash on delivery the courier has not collected yet.
+    const unpaidSplitTender: Row = { ...splitTender, status: 'issued' }
+
+    const textNode = (children: unknown[]) => ({
+      type: 'element',
+      content: { elementType: 'text', semanticType: 'p', children },
+    })
+    const totalsLine = (label: string, valuePath: string) => ({
+      type: 'element',
+      content: {
+        elementType: 'container',
+        children: [
+          textNode([{ type: 'static', content: label }]),
+          textNode([{ type: 'expr', content: `invoiceData?.Invoice?.${valuePath}` }]),
+        ],
+      },
+    })
+    const giftCardGated = (line: unknown) => ({
+      type: 'conditional',
+      content: {
+        reference: { type: 'expr', content: 'invoiceData?.Invoice?.hasGiftCard' },
+        condition: { conditions: [{ operation: '=', operand: 'true' }] },
+        node: line,
+      },
+    })
+    // The editor's default layout: the grand total, then a block holding the
+    // gift-card line and the amount-due line, both shown when a card was used.
+    const editorTemplate = loadPdfGenerator({
+      name: 'invoice-template',
+      node: {
+        type: 'element',
+        content: {
+          elementType: 'container',
+          children: [
+            totalsLine('Total:', 'total'),
+            {
+              type: 'element',
+              content: {
+                elementType: 'container',
+                children: [
+                  giftCardGated(totalsLine('Paid by gift card:', 'giftCardAmount')),
+                  giftCardGated(totalsLine('Amount due:', 'amountDue')),
+                ],
+              },
+            },
+          ],
+        },
+      },
+    })
+
+    it('prints no amount due on the PDF once the order is paid, and keeps the gift card line', () => {
+      const html = editorTemplate.buildInvoiceHtml(paidSplitTender)
+      expect(html).toContain('<p>Total:</p><p>$96.00</p>')
+      expect(html).toContain('<p>Paid by gift card:</p><p>$40.00</p>')
+      expect(html).not.toContain('Amount due')
+      expect(html).not.toContain('$56.00')
+    })
+
+    it('still prints the real amount due while the rest is not collected', () => {
+      const html = editorTemplate.buildInvoiceHtml(unpaidSplitTender)
+      expect(html).toContain('<p>Paid by gift card:</p><p>$40.00</p>')
+      expect(html).toContain('<p>Amount due:</p><p>$56.00</p>')
+    })
+
+    it('keeps a block of the merchant that holds the amount due beside another field, owing nothing', () => {
+      const merchantTemplate = loadPdfGenerator({
+        name: 'invoice-template',
+        node: {
+          type: 'element',
+          content: {
+            elementType: 'container',
+            children: [
+              textNode([
+                { type: 'static', content: 'Total ' },
+                { type: 'expr', content: 'invoiceData?.Invoice?.total' },
+              ]),
+              textNode([
+                { type: 'static', content: 'Balance ' },
+                { type: 'expr', content: 'invoiceData?.Invoice?.amountDue' },
+              ]),
+            ],
+          },
+        },
+      })
+      const html = merchantTemplate.buildInvoiceHtml(paidSplitTender)
+      expect(html).toContain('<p>Total $96.00</p><p>Balance $0.00</p>')
+    })
+
+    it('prints no amount due in the fallback HTML once the order is paid', () => {
+      const paidHtml = pdfGenerator.buildInvoiceHtml(paidSplitTender)
+      expect(paidHtml).toContain('<span>Paid by gift card ••••1234</span><span>−$40.00</span>')
+      expect(paidHtml).not.toContain('Amount due')
+
+      const unpaidHtml = pdfGenerator.buildInvoiceHtml(unpaidSplitTender)
+      expect(unpaidHtml).toContain('<span>Paid by gift card ••••1234</span><span>−$40.00</span>')
+      expect(unpaidHtml).toContain('<span>Amount due</span><span>$56.00</span>')
+    })
+
+    it('leaves the amount due out of the email of the paid order as well', () => {
+      const email = pdfGenerator.replacePlaceholders(
+        '<p>Paid by gift card −{{giftCardAmount}}</p><p>Amount due {{amountDue}}</p>',
+        pdfGenerator.buildDataContext(paidSplitTender)
+      )
+      expect(email).toBe('<p>Paid by gift card −$40.00</p>')
+    })
+  })
+
   it('fills the {{amountDue}}, {{giftCardAmount}} and {{discountAmount}} merge tokens', () => {
     const giftCard = pdfGenerator.buildDataContext(giftCardInvoice)
     expect(