@teleporthq/teleport-plugin-next-workflows 0.45.2 → 0.45.4

package/__tests__/analytics-track-outcome.test.ts

@@ -88,7 +88,7 @@ describe('analytics-track-outcome node', () => {
         value: '49.90',
         currency: 'EUR',
         outcomeId: 'ord-1',
-        attribution: { utm_source: 'facebook', visitor_id: 'aid-1' },
+        attribution: { utm_source: 'facebook', utm_content: 'hero', visitor_id: 'stale-aid' },
       },
       { __tpa: { sessionId: 'sid-1', visitorId: null, path: '/checkout' } }
     )
@@ -102,9 +102,77 @@ describe('analytics-track-outcome node', () => {
       currency: 'EUR',
       outcomeId: 'ord-1',
       sessionId: 'sid-1',
-      visitorId: 'aid-1',
+      visitorId: null,
       path: '/checkout',
-      attribution: { utmSource: 'facebook' },
+      attribution: { utmSource: 'facebook', utmContent: 'hero' },
+    })
+  })
+
+  describe('server: an order read back outside the visit that placed it', () => {
+    const configured = (calls: Array<{ body: string }>) =>
+      evalHandler(generator.generateServerHandler?.() ?? '', {
+        globalThis: {
+          process: {
+            env: {
+              NEXT_PUBLIC_TELEPORT_ANALYTICS_URL: 'https://analytics.example',
+              NEXT_PUBLIC_TELEPORT_ANALYTICS_KEY: 'tpa_key',
+              TELEPORT_ANALYTICS_SERVER_KEY: 'tpas_secret',
+            },
+          },
+        },
+        fetch: (_url: string, init: { body: string }) => {
+          calls.push(init)
+          return Promise.resolve({ status: 202 })
+        },
+        AbortController: undefined,
+      })
+
+    it('credits the visit the order names, with no ids on the context', async () => {
+      const calls: Array<{ body: string }> = []
+      await configured(calls)(
+        {
+          name: 'purchase',
+          value: '20.00',
+          currency: 'EUR',
+          outcomeId: 'ord-2',
+          attribution: {
+            session_id: 'sid-shopper',
+            visitor_id: 'aid-shopper',
+            exp: 'hero:b',
+            landing_path: '/sale',
+          },
+        },
+        {}
+      )
+      expect(JSON.parse(calls[0].body).outcomes[0]).toMatchObject({
+        outcomeId: 'ord-2',
+        sessionId: 'sid-shopper',
+        visitorId: 'aid-shopper',
+        exp: 'hero:b',
+        attribution: { landingPath: '/sale' },
+      })
+    })
+
+    it('never credits the visit of whoever runs the step', async () => {
+      const calls: Array<{ body: string }> = []
+      await configured(calls)(
+        { name: 'purchase', outcomeId: 'ord-3', attribution: { session_id: 'sid-shopper' } },
+        { __tpa: { sessionId: 'sid-merchant', visitorId: 'aid-merchant', exp: 'hero:a' } }
+      )
+      expect(JSON.parse(calls[0].body).outcomes[0]).toMatchObject({
+        sessionId: 'sid-shopper',
+        visitorId: null,
+        exp: null,
+      })
+    })
+
+    it('sends nothing for an order that resolved to no id', async () => {
+      const calls: Array<{ body: string }> = []
+      expect(await configured(calls)({ name: 'purchase', value: '20.00' }, {})).toEqual({
+        sent: false,
+        reason: 'no-outcome-id',
+      })
+      expect(calls).toEqual([])
     })
   })
 

package/__tests__/auth-password-security.test.ts

@@ -74,6 +74,10 @@ class FakePostgres {
   users: Row[] = []
   resets: Reset[] = []
   resetsTableExists = false
+  /** Off, as the site's role connects: it may read and write tables, and create none, whether or not one exists. */
+  mayCreateTables = true
+  /** Fails the statement that stores a link: the database went away between two calls. */
+  failResetWrites = false
   now = Date.UTC(2026, 9, 25, 12)
   statements: string[] = []
   // The account store cannot be read (a connection refused) for lookups by id.
@@ -85,6 +89,9 @@ class FakePostgres {
       return { rows: [] }
     }
     if (sql.startsWith('CREATE TABLE IF NOT EXISTS teleport_password_resets')) {
+      if (!this.mayCreateTables) {
+        throw Object.assign(new Error('permission denied for schema public'), { code: '42501' })
+      }
       this.resetsTableExists = true
       return { rows: [] }
     }
@@ -134,6 +141,12 @@ class FakePostgres {
         code: '42P01',
       })
     }
+    if (sql === 'SELECT 1 FROM teleport_password_resets LIMIT 1') {
+      return { rows: [] }
+    }
+    if (this.failResetWrites && sql.startsWith('INSERT INTO teleport_password_resets')) {
+      throw Object.assign(new Error('Connection terminated unexpectedly'), { code: '57P01' })
+    }
     if (sql.startsWith('UPDATE teleport_password_resets SET used_at = NOW() WHERE user_id = $1')) {
       for (const reset of this.resets) {
         if (reset.user_id === values[0] && reset.used_at === null) {
@@ -428,6 +441,7 @@ const loadApp = (
 }
 
 const VICTIM = { id: 'u-victim', email: 'victim@site.test', name: 'Vic', role: 'admin' }
+const FORGOT_PASSWORD_NOT_SENT = 'We could not send the reset link. Please try again in a moment.'
 
 const tokenFromEmail = (sent: Row[]): string => {
   const mail = sent.find((entry) => entry.to)
@@ -576,6 +590,93 @@ describe('A3-C1: forgot / reset password are decided on the server', () => {
     expect(app.delays.length).toBeGreaterThan(0)
   })
 
+  const asksToCreate = (db: FakePostgres) =>
+    db.statements.filter((sql) => /\bCREATE\b|pg_advisory_xact_lock/.test(sql))
+
+  it('stores a link in the table the editor made, never asking to create it', async () => {
+    const db = victimDb()
+    db.resetsTableExists = true
+    db.mayCreateTables = false
+    const app = loadApp({ db })
+    const res = fakeResponse()
+
+    await app.load('forgot')(request({ email: VICTIM.email }), res)
+
+    expect(res.statusCode).toBe(200)
+    expect(res.body).toEqual({ success: true, message: FORGOT_PASSWORD_ANSWER })
+    expect(db.resets).toHaveLength(1)
+    expect(app.sent.filter((entry) => entry.to)).toHaveLength(1)
+    expect(asksToCreate(db)).toEqual([])
+  })
+
+  it('creates the table only when it is really missing, then stores the link in it', async () => {
+    const db = victimDb()
+    const app = loadApp({ db })
+    await app.load('forgot')(request({ email: VICTIM.email }), fakeResponse())
+
+    expect(asksToCreate(db).map((sql) => sql.split(' (')[0])).toEqual([
+      'SELECT pg_advisory_xact_lock(hashtext($1))',
+      'CREATE TABLE IF NOT EXISTS teleport_password_resets',
+      'CREATE INDEX IF NOT EXISTS teleport_password_resets_user_id_idx ON teleport_password_resets',
+    ])
+    expect(db.resets).toHaveLength(1)
+    expect(app.sent.filter((entry) => entry.to)).toHaveLength(1)
+  })
+
+  it('stores a sign-up set-password link the same way when the table went missing', async () => {
+    const db = victimDb()
+    const app = loadApp({ db })
+    await app.load('options').storePasswordReset(VICTIM.id, 'hash', 1800)
+    expect(db.resets).toHaveLength(1)
+
+    const refused = victimDb()
+    refused.mayCreateTables = false
+    const refusedApp = loadApp({ db: refused })
+    await expect(
+      refusedApp.load('options').storePasswordReset(VICTIM.id, 'hash', 1800)
+    ).rejects.toThrow(
+      'the table teleport_password_resets is missing and could not be created: permission denied for schema public'
+    )
+    expect(refused.statements).toContain('ROLLBACK')
+  })
+
+  it('tells no one a link was sent when the table is missing and cannot be made, naming it in the log', async () => {
+    const db = victimDb()
+    db.mayCreateTables = false
+    const app = loadApp({ db })
+    const known = fakeResponse()
+    await app.load('forgot')(request({ email: VICTIM.email }), known)
+    const unknown = fakeResponse()
+    await app.load('forgot')(request({ email: 'nobody@site.test' }), unknown)
+
+    for (const res of [known, unknown]) {
+      expect(res.statusCode).toBe(503)
+      expect(res.body.error).toBe(FORGOT_PASSWORD_NOT_SENT)
+      expect(res.body).not.toHaveProperty('success')
+    }
+    expect(db.resets).toEqual([])
+    expect(app.sent).toEqual([])
+    const logged = app.logs.map((args) => args.map(String).join(' ')).join('\n')
+    expect(logged).toContain('teleport_password_resets')
+    expect(logged).toContain('permission denied for schema public')
+  })
+
+  it('tells no one a link was sent when storing it fails', async () => {
+    const db = victimDb()
+    db.resetsTableExists = true
+    db.failResetWrites = true
+    const app = loadApp({ db })
+    const res = fakeResponse()
+
+    await app.load('forgot')(request({ email: VICTIM.email }), res)
+
+    expect(res.statusCode).toBe(503)
+    expect(res.body.error).toBe(FORGOT_PASSWORD_NOT_SENT)
+    expect(app.sent).toEqual([])
+    // Waits out the same minimum, so the time tells nothing either.
+    expect(app.delays.length).toBeGreaterThan(0)
+  })
+
   it('sends one address at most 3 links an hour, answering the same', async () => {
     const app = loadApp({ db: victimDb() })
     for (let i = 0; i < 5; i++) {

package/__tests__/automations-bus.test.ts

@@ -359,6 +359,10 @@ class FakeDatabase {
   signedRequests = new Map<string, number>()
   /** Fails every statement on the signed-request table. */
   signedRequestsDown = false
+  /** The editor did not make the signed-request table. */
+  signedRequestsMissing = false
+  /** As the site's role connects: it may read and write tables, and create none, whether or not one exists. */
+  mayCreateTables = false
   private serial = 0
 
   query(sql: string, values: unknown[] = []): { rows: Row[]; rowCount?: number } {
@@ -381,8 +385,17 @@ class FakeDatabase {
         text ===
           'CREATE INDEX IF NOT EXISTS teleport_automation_requests_expires_at ON teleport_automation_requests (expires_at)'
       ) {
+        if (!this.mayCreateTables) {
+          throw Object.assign(new Error('permission denied for schema public'), { code: '42501' })
+        }
+        this.signedRequestsMissing = false
         return { rows: [] }
       }
+      if (this.signedRequestsMissing) {
+        throw Object.assign(new Error('relation "teleport_automation_requests" does not exist'), {
+          code: '42P01',
+        })
+      }
       if (
         text ===
         'DELETE FROM teleport_automation_requests WHERE request_key IN (SELECT request_key FROM teleport_automation_requests WHERE expires_at < $1 LIMIT 1000)'
@@ -3055,7 +3068,12 @@ describe('in-app event bus — emitting and the dispatch route', () => {
   })
 
   // A request sent exactly as it was captured: the same headers, the same body.
-  const resend = async (db: FakeDatabase, headers: Record<string, string>, rawBody: string) => {
+  const resend = async (
+    db: FakeDatabase,
+    headers: Record<string, string>,
+    rawBody: string,
+    logging: typeof silenced = silenced
+  ) => {
     const reply = { status: 0, body: null as unknown }
     const res = {
       setHeader: () => undefined,
@@ -3082,7 +3100,7 @@ describe('in-app event bus — emitting and the dispatch route', () => {
     const calls = await withEcho(
       async (recorded) => {
         const handler = createApp(files, db)('pages/api/automations/dispatch.js') as RouteHandler
-        await silenced(() => handler(req, res))
+        await logging(() => handler(req, res))
         return recorded
       },
       { TELEPORT_CRON_SECRET: CRON_KEY }
@@ -3145,6 +3163,71 @@ describe('in-app event bus — emitting and the dispatch route', () => {
     expect(down.deliveries).toEqual([])
   })
 
+  const asksToCreate = (db: FakeDatabase) =>
+    db.statements.filter((statement) => /\bCREATE\b|pg_advisory_xact_lock/.test(statement))
+
+  it('takes a signed request in the table the editor made, never asking to create it', async () => {
+    const db = new FakeDatabase()
+    seedOrderPaid(db)
+
+    const { reply } = await resend(db, signedHeaders('{}', false), '{}')
+
+    expect(reply.status).toBe(200)
+    expect(db.signedRequests.size).toBe(1)
+    expect(asksToCreate(db)).toEqual([])
+  })
+
+  it('creates the table only when it is really missing, then takes the request in it', async () => {
+    const db = new FakeDatabase()
+    seedOrderPaid(db)
+    db.signedRequestsMissing = true
+    db.mayCreateTables = true
+    const headers = signedHeaders('{}', false)
+
+    expect((await resend(db, headers, '{}')).reply.status).toBe(200)
+    expect(asksToCreate(db)).toEqual([
+      'SELECT pg_advisory_xact_lock(hashtext($1))',
+      'CREATE TABLE IF NOT EXISTS teleport_automation_requests (request_key TEXT PRIMARY KEY, expires_at BIGINT NOT NULL)',
+      'CREATE INDEX IF NOT EXISTS teleport_automation_requests_expires_at ON teleport_automation_requests (expires_at)',
+    ])
+    expect(db.signedRequests.size).toBe(1)
+
+    // Replays are still refused, and the table is not asked for again.
+    db.statements.length = 0
+    expect((await resend(db, headers, '{}')).reply.status).toBe(409)
+    expect(asksToCreate(db)).toEqual([])
+  })
+
+  it('refuses a request when its table is missing and cannot be made, naming the table in the log', async () => {
+    const db = new FakeDatabase()
+    seedOrderPaid(db)
+    db.signedRequestsMissing = true
+    const logged: unknown[][] = []
+    const capturingErrors = async <T>(run: () => Promise<T>): Promise<T> => {
+      const sink = jest.spyOn(console, 'error').mockImplementation((...args) => {
+        logged.push(args)
+      })
+      try {
+        return await run()
+      } finally {
+        sink.mockRestore()
+      }
+    }
+
+    const { reply } = await resend(db, signedHeaders('{}', false), '{}', capturingErrors)
+
+    expect(reply).toEqual({
+      status: 503,
+      body: { error: 'The request could not be checked. Try again.' },
+    })
+    expect(db.deliveries).toEqual([])
+    expect(db.signedRequests.size).toBe(0)
+    expect(db.statements).toContain('ROLLBACK')
+    const said = logged.map((args) => args.map(String).join(' ')).join('\n')
+    expect(said).toContain('teleport_automation_requests')
+    expect(said).toContain('permission denied for schema public')
+  })
+
   it('refuses a caller without the app secret or a cron signature', async () => {
     const db = new FakeDatabase()
     seedOrderPaid(db)

package/__tests__/security-lists-parity.test.ts

@@ -176,7 +176,7 @@ describe('the runtime process shadow in general-custom-js', () => {
 describeCopiesOf('teleport-gui', GUI)('the editor copies (teleport-gui)', () => {
   it('protect the same env names and credential pattern', () => {
     const copy = loadTs(GUI_FILES.protectedNames)
-    expect([...copy.PROTECTED_ENV_NAMES]).toEqual(CODEGEN.names)
+    expect([...copy.PROTECTED_ENV_NAMES].sort()).toEqual([...CODEGEN.names].sort())
     expect(patternOf(copy.PROTECTED_ENV_NAME_PATTERN)).toEqual(CODEGEN.pattern)
     expect(patternOf(copy.PLATFORM_ENV_NAME_PATTERN)).toEqual(CODEGEN.platformPattern)
     expect(patternOf(copy.INTEGRATION_ENV_NAME_PATTERN)).toEqual(CODEGEN.integrationPattern)
@@ -212,7 +212,7 @@ describeCopiesOf('teleport-services-worker', WORKER)(
   () => {
     it('protect the same env names and credential pattern', () => {
       const copy = loadTs(WORKER_FILES.protectedNames)
-      expect([...copy.PROTECTED_ENV_NAMES]).toEqual(CODEGEN.names)
+      expect([...copy.PROTECTED_ENV_NAMES].sort()).toEqual([...CODEGEN.names].sort())
       expect(patternOf(copy.PROTECTED_ENV_NAME_PATTERN)).toEqual(CODEGEN.pattern)
       expect(patternOf(copy.PLATFORM_ENV_NAME_PATTERN)).toEqual(CODEGEN.platformPattern)
       expect(patternOf(copy.INTEGRATION_ENV_NAME_PATTERN)).toEqual(CODEGEN.integrationPattern)

package/__tests__/security-runtime.test.ts

@@ -61,7 +61,9 @@ class FakeDatabase {
   /** `connect`: connect() never settles; `query`: no query settles; `cleanup`: the DELETE never settles. */
   hang: 'connect' | 'query' | 'cleanup' | null = null
   connectDelayMs = 0
-  tableExists = false
+  tableExists = true
+  /** Off, as the site's role connects: it may read and write tables, and create none, whether or not one exists. */
+  mayCreateTables = true
 
   rowKey(key: unknown, windowStart: unknown): string {
     return `${key} @ ${windowStart}`
@@ -93,6 +95,9 @@ class FakeDatabase {
       return none
     }
     if (sql === CREATE_SQL) {
+      if (!this.mayCreateTables) {
+        throw Object.assign(new Error('permission denied for schema public'), { code: '42501' })
+      }
       this.tableExists = true
       return none
     }
@@ -287,44 +292,56 @@ describe('rateLimit — Postgres-backed', () => {
     expect(wire).not.toContain('203.0.113.7')
   })
 
-  it('creates its table and index once per instance, under an advisory lock', async () => {
+  it('counts in the table the editor made, never asking to create it', async () => {
     const db = new FakeDatabase()
-    const clock = { now: MIDNIGHT + 5000 }
-    const { runtime } = loadRuntime({ db, clock })
+    db.mayCreateTables = false
+    const { runtime, log } = loadRuntime({ db, clock: { now: MIDNIGHT + 5000 } })
     await runtime.rateLimit({ key: 'k', limit: 5, windowSeconds: 60 })
     await settle()
     await runtime.rateLimit({ key: 'k', limit: 5, windowSeconds: 60 })
-    expect(db.queries.map((query) => query.sql)).toEqual([
+    expect(db.queries.map((query) => query.sql)).toEqual([HIT_SQL, CLEANUP_SQL, HIT_SQL])
+    expect(Array.from(db.rows.values()).map((row) => row.count)).toEqual([2])
+    expect(log.error).not.toHaveBeenCalled()
+  })
+
+  it('creates the table when it is really missing, under an advisory lock, within the same request', async () => {
+    const db = new FakeDatabase()
+    const { runtime, log } = loadRuntime({ db, clock: { now: MIDNIGHT + 5000 } })
+    await runtime.rateLimit({ key: 'k', limit: 5, windowSeconds: 60 })
+    // Dropped, or the database restored from a backup taken before it existed.
+    db.dropTable()
+    db.queries.length = 0
+    expect(await runtime.rateLimit({ key: 'k', limit: 5, windowSeconds: 60 })).toEqual({
+      allowed: true,
+      retryAfter: 0,
+    })
+    expect(db.queries.map((query) => query.sql).slice(0, 7)).toEqual([
+      HIT_SQL,
       'BEGIN',
       LOCK_SQL,
       CREATE_SQL,
       INDEX_SQL,
       'COMMIT',
       HIT_SQL,
-      CLEANUP_SQL,
-      HIT_SQL,
     ])
-    // A second instance creates them again (IF NOT EXISTS), under the same lock.
-    await loadRuntime({ db, clock }).runtime.rateLimit({ key: 'k', limit: 5, windowSeconds: 60 })
-    expect(db.statements(CREATE_SQL)).toHaveLength(2)
-    expect(db.statements(INDEX_SQL)).toHaveLength(2)
-    expect(db.statements(LOCK_SQL)).toHaveLength(2)
+    // Counted in the database, not in memory.
+    expect(Array.from(db.rows.values()).map((row) => row.count)).toEqual([1])
+    expect(log.error).not.toHaveBeenCalled()
   })
 
-  it('creates the table again, within the same request, when it went missing', async () => {
+  it('counts in memory, naming the table in the log, when it is missing and cannot be made', async () => {
     const db = new FakeDatabase()
-    const { runtime, log } = loadRuntime({ db, clock: { now: MIDNIGHT + 5000 } })
-    await runtime.rateLimit({ key: 'k', limit: 5, windowSeconds: 60 })
-    // Dropped, or the database restored from a backup taken before it existed.
     db.dropTable()
+    db.mayCreateTables = false
+    const { runtime, log } = loadRuntime({ db, clock: { now: MIDNIGHT + 5000 } })
     expect(await runtime.rateLimit({ key: 'k', limit: 5, windowSeconds: 60 })).toEqual({
       allowed: true,
       retryAfter: 0,
     })
-    expect(db.statements(CREATE_SQL)).toHaveLength(2)
-    // Counted in the database, not in memory.
-    expect(Array.from(db.rows.values()).map((row) => row.count)).toEqual([1])
-    expect(log.error).not.toHaveBeenCalled()
+    expect(log.error).toHaveBeenCalledTimes(1)
+    expect(String(log.error.mock.calls[0][0])).toContain(
+      'the table teleport_rate_limits is missing and could not be created: permission denied for schema public'
+    )
   })
 
   it('keeps one counter per window length, so a minute and a day limit never share a row', async () => {

package/dist/cjs/auth-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-generator.d.ts","sourceRoot":"","sources":["../../src/auth-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,cAAc,EACf,MAAM,4BAA4B,CAAA;AAsBnC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,sBAAsB,MAAM,CAAA;AACzC,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAC/C,qCAAqC;AACrC,eAAO,MAAM,aAAa,KAAK,CAAA;AAC/B;;;GAGG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAA;AAC7C,eAAO,MAAM,sBAAsB,OAAO,CAAA;AAY1C,eAAO,MAAM,6BAA6B,mBACxB,cAAc,GAAG,IAAI,KACpC,OAAO,MAAM,EAAE,MAAM,CA0BvB,CAAA;AAwID;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,QAAQ,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAQrD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAalD,CAAA;AAkBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,WACzB,OAAO,MAAM,EAAE,mBAAmB,EAAE,CAAC,GAAG,SAAS,eAC5C,sBAAsB,EAAE,KACpC,MAAM,EAUR,CAAA;AA8FD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAAoC,CAAA;AAqTpF,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,6BAA6B,CAAA;AA2Y/D,eAAO,MAAM,uBAAuB,SAC5B,kBAAkB,qBACL,OAAO,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KAChD,MA0OF,CAAA;AAoMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,SAAU,kBAAkB,KAAG,OAWhE,CAAA;AAoID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,QAAO,MA8ChD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAO,MAkD3C,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,IAAI,CAAA;AACpC,eAAO,MAAM,kBAAkB,MAAM,CAAA;AAErC,eAAO,MAAM,wBAAwB,QAAO,MAqF3C,CAAA;AAED,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AA6DD,eAAO,MAAM,yBAAyB,aAAa,oBAAoB,KAAQ,MAkH9E,CAAA;AAMD,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IAGtB,kBAAkB,CAAC,EAAE,2BAA2B,CAAA;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,YAAa;IACpD,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,KAAG,MAsCH,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAS,MAAM,KAAG,OACP,CAAA;AAY7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,SACxB,kBAAkB,qBACL,MAAM,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,KAChD,MAAM,EAeR,CAAA;AAED,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,uBAAuB,CAAA;IACrC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAoBD,oGAAoG;AACpG,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAA;AAsIjD,eAAO,MAAM,uBAAuB,SAC5B,kBAAkB,YACf,mBAAmB,WACpB,mBAAmB,WACnB,kBAAkB,KACzB,MAiRF,CAAA;AA2ED,MAAM,WAAW,iBAAiB;IAIhC,yBAAyB,CAAC,EAAE,MAAM,CAAA;CACnC;AA4FD,eAAO,MAAM,sBAAsB,SAC3B,kBAAkB,YACf,iBAAiB,KACzB,MAwaF,CAAA;AAoBD,eAAO,MAAM,8BAA8B,QAAO,MA6BjD,CAAA;AAED,eAAO,MAAM,8BAA8B,QAAO,MAiHjD,CAAA"}
+{"version":3,"file":"auth-generator.d.ts","sourceRoot":"","sources":["../../src/auth-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,cAAc,EACf,MAAM,4BAA4B,CAAA;AAsBnC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,sBAAsB,MAAM,CAAA;AACzC,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAC/C,qCAAqC;AACrC,eAAO,MAAM,aAAa,KAAK,CAAA;AAC/B;;;GAGG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAA;AAC7C,eAAO,MAAM,sBAAsB,OAAO,CAAA;AAY1C,eAAO,MAAM,6BAA6B,mBACxB,cAAc,GAAG,IAAI,KACpC,OAAO,MAAM,EAAE,MAAM,CA0BvB,CAAA;AAwID;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,QAAQ,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAQrD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAalD,CAAA;AAkBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,WACzB,OAAO,MAAM,EAAE,mBAAmB,EAAE,CAAC,GAAG,SAAS,eAC5C,sBAAsB,EAAE,KACpC,MAAM,EAUR,CAAA;AA8FD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAAoC,CAAA;AAqTpF,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,6BAA6B,CAAA;AAua/D,eAAO,MAAM,uBAAuB,SAC5B,kBAAkB,qBACL,OAAO,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KAChD,MA2OF,CAAA;AAoMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,SAAU,kBAAkB,KAAG,OAWhE,CAAA;AAoID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,QAAO,MA8ChD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAO,MAkD3C,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,IAAI,CAAA;AACpC,eAAO,MAAM,kBAAkB,MAAM,CAAA;AAErC,eAAO,MAAM,wBAAwB,QAAO,MAqF3C,CAAA;AAED,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AA6DD,eAAO,MAAM,yBAAyB,aAAa,oBAAoB,KAAQ,MAkH9E,CAAA;AAMD,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IAGtB,kBAAkB,CAAC,EAAE,2BAA2B,CAAA;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,YAAa;IACpD,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,KAAG,MAsCH,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAS,MAAM,KAAG,OACP,CAAA;AAY7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,SACxB,kBAAkB,qBACL,MAAM,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,KAChD,MAAM,EAeR,CAAA;AAED,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,uBAAuB,CAAA;IACrC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAoBD,oGAAoG;AACpG,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAA;AAsIjD,eAAO,MAAM,uBAAuB,SAC5B,kBAAkB,YACf,mBAAmB,WACpB,mBAAmB,WACnB,kBAAkB,KACzB,MAiRF,CAAA;AA2ED,MAAM,WAAW,iBAAiB;IAIhC,yBAAyB,CAAC,EAAE,MAAM,CAAA;CACnC;AA4FD,eAAO,MAAM,sBAAsB,SAC3B,kBAAkB,YACf,iBAAiB,KACzB,MAwaF,CAAA;AAoBD,eAAO,MAAM,8BAA8B,QAAO,MA6BjD,CAAA;AAED,eAAO,MAAM,8BAA8B,QAAO,MAiHjD,CAAA"}

package/dist/cjs/auth-generator.js

@@ -665,13 +665,15 @@ exports.PASSWORD_RESETS_TABLE = 'teleport_password_resets';
 const PG_PASSWORD_RESET_FUNCTIONS = `
 // Password-reset links (pages/api/auth/forgot-password + reset-password). Only
 // the SHA-256 of a link's token is stored, bound to the account id, with its
-// expiry; the table is created on first use. The earlier password_reset_tokens
-// table and its rows are never read.
+// expiry. The editor makes the table with the other account tables, and a site's
+// database role may read and write it without being allowed to create one
+// (CREATE ... IF NOT EXISTS asks for that permission even when the table is
+// there), so a create is attempted only for a table that really is missing. The
+// earlier password_reset_tokens table and its rows are never read.
 var PASSWORD_RESETS_TABLE = '${exports.PASSWORD_RESETS_TABLE}';
-var __passwordResetsTableReady = false;
+var UNDEFINED_TABLE_CODE = '42P01';
 
-async function ensurePasswordResetsTable(client) {
-  if (__passwordResetsTableReady) return;
+async function createPasswordResetsTable(client) {
   await client.query('BEGIN');
   try {
     await client.query('SELECT pg_advisory_xact_lock(hashtext($1))', [PASSWORD_RESETS_TABLE]);
@@ -683,28 +685,53 @@ async function ensurePasswordResetsTable(client) {
     await client.query('COMMIT');
   } catch (err) {
     try { await client.query('ROLLBACK'); } catch (_e) {}
-    throw err;
+    throw new Error('[password-reset] the table ' + PASSWORD_RESETS_TABLE + ' is missing and could not be created: ' + (err && err.message ? err.message : String(err)));
+  }
+}
+
+// Throws when a link could not be kept. Asked for every address, with an account
+// or without, so a table that cannot be used refuses them all alike.
+async function ensurePasswordResetsUsable() {
+  const client = getClient();
+  try {
+    await client.connect();
+    try {
+      await client.query('SELECT 1 FROM ' + PASSWORD_RESETS_TABLE + ' LIMIT 1');
+    } catch (err) {
+      if (!err || err.code !== UNDEFINED_TABLE_CODE) throw err;
+      await createPasswordResetsTable(client);
+    }
+  } finally {
+    try { await client.end(); } catch (_e) {}
   }
-  __passwordResetsTableReady = true;
 }
 
 // One live link per account: a new one ends the ones sent before it.
+async function writePasswordReset(client, userId, tokenHash, ttlSeconds) {
+  await client.query(
+    'UPDATE ' + PASSWORD_RESETS_TABLE + ' SET used_at = NOW() WHERE user_id = $1 AND used_at IS NULL',
+    [String(userId)]
+  );
+  await client.query(
+    'INSERT INTO ' + PASSWORD_RESETS_TABLE + " (token_hash, user_id, expires_at) VALUES ($1, $2, NOW() + ($3::int * INTERVAL '1 second'))",
+    [tokenHash, String(userId), ttlSeconds]
+  );
+  await client.query(
+    'DELETE FROM ' + PASSWORD_RESETS_TABLE + " WHERE expires_at < NOW() - INTERVAL '1 day'"
+  );
+}
+
 async function storePasswordReset(userId, tokenHash, ttlSeconds) {
   const client = getClient();
   try {
     await client.connect();
-    await ensurePasswordResetsTable(client);
-    await client.query(
-      'UPDATE ' + PASSWORD_RESETS_TABLE + ' SET used_at = NOW() WHERE user_id = $1 AND used_at IS NULL',
-      [String(userId)]
-    );
-    await client.query(
-      'INSERT INTO ' + PASSWORD_RESETS_TABLE + " (token_hash, user_id, expires_at) VALUES ($1, $2, NOW() + ($3::int * INTERVAL '1 second'))",
-      [tokenHash, String(userId), ttlSeconds]
-    );
-    await client.query(
-      'DELETE FROM ' + PASSWORD_RESETS_TABLE + " WHERE expires_at < NOW() - INTERVAL '1 day'"
-    );
+    try {
+      await writePasswordReset(client, userId, tokenHash, ttlSeconds);
+    } catch (err) {
+      if (!err || err.code !== UNDEFINED_TABLE_CODE) throw err;
+      await createPasswordResetsTable(client);
+      await writePasswordReset(client, userId, tokenHash, ttlSeconds);
+    }
   } finally {
     try { await client.end(); } catch (_e) {}
   }
@@ -759,6 +786,7 @@ const PASSWORD_RESET_SUPPORTED = true;`;
 const UNSUPPORTED_PASSWORD_RESET_FUNCTIONS = `
 // Password-reset links need a Postgres database; this project's user store is
 // not one, so the reset routes answer without ever sending a link.
+async function ensurePasswordResetsUsable() { throw new Error('Password reset needs a Postgres database'); }
 async function storePasswordReset() { throw new Error('Password reset needs a Postgres database'); }
 async function consumePasswordReset() { return null; }
 async function passwordResetIsLive() { return false; }
@@ -1248,6 +1276,7 @@ ${auth.passwordAuthEnabled
 module.exports.checkSignInAllowed = checkSignInAllowed;
 module.exports.countSignInFailure = countSignInFailure;
 module.exports.SIGN_IN_VISITOR_HEADER = SIGN_IN_VISITOR_HEADER;
+module.exports.ensurePasswordResetsUsable = ensurePasswordResetsUsable;
 module.exports.storePasswordReset = storePasswordReset;
 module.exports.consumePasswordReset = consumePasswordReset;
 module.exports.passwordResetIsLive = passwordResetIsLive;