@teleporthq/teleport-plugin-next-workflows 0.45.2 → 0.45.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teleporthq/teleport-plugin-next-workflows",
-  "version": "0.45.2",
+  "version": "0.45.4",
   "description": "A plugin for workflow code generation in Next.js projects.",
   "author": "teleportHQ",
   "license": "MIT",
@@ -69,5 +69,5 @@
     "@teleporthq/teleport-shared": "^0.45.0",
     "@teleporthq/teleport-types": "^0.45.0"
   },
-  "gitHead": "3be925a09c56ec0afe44940a623cbfcc54e5170f"
+  "gitHead": "4fc86526c794a1304f0298809bf3530b4d380486"
 }

package/src/auth-generator.ts

@@ -730,13 +730,15 @@ export const PASSWORD_RESETS_TABLE = 'teleport_password_resets'
 const PG_PASSWORD_RESET_FUNCTIONS = `
 // Password-reset links (pages/api/auth/forgot-password + reset-password). Only
 // the SHA-256 of a link's token is stored, bound to the account id, with its
-// expiry; the table is created on first use. The earlier password_reset_tokens
-// table and its rows are never read.
+// expiry. The editor makes the table with the other account tables, and a site's
+// database role may read and write it without being allowed to create one
+// (CREATE ... IF NOT EXISTS asks for that permission even when the table is
+// there), so a create is attempted only for a table that really is missing. The
+// earlier password_reset_tokens table and its rows are never read.
 var PASSWORD_RESETS_TABLE = '${PASSWORD_RESETS_TABLE}';
-var __passwordResetsTableReady = false;
+var UNDEFINED_TABLE_CODE = '42P01';
 
-async function ensurePasswordResetsTable(client) {
-  if (__passwordResetsTableReady) return;
+async function createPasswordResetsTable(client) {
   await client.query('BEGIN');
   try {
     await client.query('SELECT pg_advisory_xact_lock(hashtext($1))', [PASSWORD_RESETS_TABLE]);
@@ -748,28 +750,53 @@ async function ensurePasswordResetsTable(client) {
     await client.query('COMMIT');
   } catch (err) {
     try { await client.query('ROLLBACK'); } catch (_e) {}
-    throw err;
+    throw new Error('[password-reset] the table ' + PASSWORD_RESETS_TABLE + ' is missing and could not be created: ' + (err && err.message ? err.message : String(err)));
+  }
+}
+
+// Throws when a link could not be kept. Asked for every address, with an account
+// or without, so a table that cannot be used refuses them all alike.
+async function ensurePasswordResetsUsable() {
+  const client = getClient();
+  try {
+    await client.connect();
+    try {
+      await client.query('SELECT 1 FROM ' + PASSWORD_RESETS_TABLE + ' LIMIT 1');
+    } catch (err) {
+      if (!err || err.code !== UNDEFINED_TABLE_CODE) throw err;
+      await createPasswordResetsTable(client);
+    }
+  } finally {
+    try { await client.end(); } catch (_e) {}
   }
-  __passwordResetsTableReady = true;
 }
 
 // One live link per account: a new one ends the ones sent before it.
+async function writePasswordReset(client, userId, tokenHash, ttlSeconds) {
+  await client.query(
+    'UPDATE ' + PASSWORD_RESETS_TABLE + ' SET used_at = NOW() WHERE user_id = $1 AND used_at IS NULL',
+    [String(userId)]
+  );
+  await client.query(
+    'INSERT INTO ' + PASSWORD_RESETS_TABLE + " (token_hash, user_id, expires_at) VALUES ($1, $2, NOW() + ($3::int * INTERVAL '1 second'))",
+    [tokenHash, String(userId), ttlSeconds]
+  );
+  await client.query(
+    'DELETE FROM ' + PASSWORD_RESETS_TABLE + " WHERE expires_at < NOW() - INTERVAL '1 day'"
+  );
+}
+
 async function storePasswordReset(userId, tokenHash, ttlSeconds) {
   const client = getClient();
   try {
     await client.connect();
-    await ensurePasswordResetsTable(client);
-    await client.query(
-      'UPDATE ' + PASSWORD_RESETS_TABLE + ' SET used_at = NOW() WHERE user_id = $1 AND used_at IS NULL',
-      [String(userId)]
-    );
-    await client.query(
-      'INSERT INTO ' + PASSWORD_RESETS_TABLE + " (token_hash, user_id, expires_at) VALUES ($1, $2, NOW() + ($3::int * INTERVAL '1 second'))",
-      [tokenHash, String(userId), ttlSeconds]
-    );
-    await client.query(
-      'DELETE FROM ' + PASSWORD_RESETS_TABLE + " WHERE expires_at < NOW() - INTERVAL '1 day'"
-    );
+    try {
+      await writePasswordReset(client, userId, tokenHash, ttlSeconds);
+    } catch (err) {
+      if (!err || err.code !== UNDEFINED_TABLE_CODE) throw err;
+      await createPasswordResetsTable(client);
+      await writePasswordReset(client, userId, tokenHash, ttlSeconds);
+    }
   } finally {
     try { await client.end(); } catch (_e) {}
   }
@@ -825,6 +852,7 @@ const PASSWORD_RESET_SUPPORTED = true;`
 const UNSUPPORTED_PASSWORD_RESET_FUNCTIONS = `
 // Password-reset links need a Postgres database; this project's user store is
 // not one, so the reset routes answer without ever sending a link.
+async function ensurePasswordResetsUsable() { throw new Error('Password reset needs a Postgres database'); }
 async function storePasswordReset() { throw new Error('Password reset needs a Postgres database'); }
 async function consumePasswordReset() { return null; }
 async function passwordResetIsLive() { return false; }
@@ -1349,6 +1377,7 @@ ${
 module.exports.checkSignInAllowed = checkSignInAllowed;
 module.exports.countSignInFailure = countSignInFailure;
 module.exports.SIGN_IN_VISITOR_HEADER = SIGN_IN_VISITOR_HEADER;
+module.exports.ensurePasswordResetsUsable = ensurePasswordResetsUsable;
 module.exports.storePasswordReset = storePasswordReset;
 module.exports.consumePasswordReset = consumePasswordReset;
 module.exports.passwordResetIsLive = passwordResetIsLive;

package/src/automations/event-bus-source.ts

@@ -89,10 +89,15 @@ async function saveWait(wait) {
 
 // The signed requests the dispatch route has taken, each kept until its
 // signature can no longer verify: the same request again is refused. The
-// table (and its expiry index) is made on first use, two instances taking
-// turns under the lock. The rows that are over are deleted at most once per
-// instance every SIGNED_REQUESTS_CLEANUP_MS, a bounded batch at a time.
+// editor makes the table with the other automation tables, and a site's
+// database role may read and write it without being allowed to create one
+// (CREATE ... IF NOT EXISTS asks for that permission even when the table is
+// there), so a create is attempted only for a table that really is missing,
+// two instances taking turns under the lock. The rows that are over are
+// deleted at most once per instance every SIGNED_REQUESTS_CLEANUP_MS, a
+// bounded batch at a time.
 var SIGNED_REQUESTS_TABLE = '${SIGNED_REQUESTS_TABLE}';
+var UNDEFINED_TABLE_CODE = '42P01';
 var LOCK_SIGNED_REQUESTS_SQL = 'SELECT pg_advisory_xact_lock(hashtext($1))';
 var CREATE_SIGNED_REQUESTS_SQL = 'CREATE TABLE IF NOT EXISTS ' + SIGNED_REQUESTS_TABLE +
   ' (request_key TEXT PRIMARY KEY, expires_at BIGINT NOT NULL)';
@@ -103,34 +108,43 @@ var FORGET_SIGNED_REQUESTS_SQL = 'DELETE FROM ' + SIGNED_REQUESTS_TABLE + ' WHER
 var TAKE_SIGNED_REQUEST_SQL = 'INSERT INTO ' + SIGNED_REQUESTS_TABLE + ' (request_key, expires_at) VALUES ($1, $2) ' +
   'ON CONFLICT (request_key) DO NOTHING RETURNING request_key';
 var SIGNED_REQUESTS_CLEANUP_MS = 600000;
-var __signedRequestsReady = false;
 var __signedRequestsCleanedAt = 0;
 
+async function createSignedRequestsTable(client) {
+  await client.query('BEGIN');
+  try {
+    await client.query(LOCK_SIGNED_REQUESTS_SQL, [SIGNED_REQUESTS_TABLE]);
+    await client.query(CREATE_SIGNED_REQUESTS_SQL);
+    await client.query(INDEX_SIGNED_REQUESTS_SQL);
+    await client.query('COMMIT');
+  } catch (error) {
+    try { await client.query('ROLLBACK'); } catch (_e) {}
+    throw new Error('[automations] the table ' + SIGNED_REQUESTS_TABLE + ' is missing and could not be created: ' + errorMessage(error));
+  }
+}
+
+async function recordSignedRequest(client, key, expiresAt) {
+  var nowMs = Date.now();
+  if (nowMs - __signedRequestsCleanedAt >= SIGNED_REQUESTS_CLEANUP_MS) {
+    __signedRequestsCleanedAt = nowMs;
+    await client.query(FORGET_SIGNED_REQUESTS_SQL, [Math.floor(nowMs / 1000)]);
+  }
+  var taken = await client.query(TAKE_SIGNED_REQUEST_SQL, [key, expiresAt]);
+  return !!(taken && taken.rows && taken.rows[0]);
+}
+
 // true the first time a signed request (its key) is taken, false every time
 // after while it is kept (until expiresAt, unix seconds). Throws when the
 // database cannot say: the route then refuses.
 async function takeSignedRequest(key, expiresAt) {
   return withClient(async function (client) {
-    if (!__signedRequestsReady) {
-      await client.query('BEGIN');
-      try {
-        await client.query(LOCK_SIGNED_REQUESTS_SQL, [SIGNED_REQUESTS_TABLE]);
-        await client.query(CREATE_SIGNED_REQUESTS_SQL);
-        await client.query(INDEX_SIGNED_REQUESTS_SQL);
-        await client.query('COMMIT');
-      } catch (error) {
-        try { await client.query('ROLLBACK'); } catch (_e) {}
-        throw error;
-      }
-      __signedRequestsReady = true;
-    }
-    var nowMs = Date.now();
-    if (nowMs - __signedRequestsCleanedAt >= SIGNED_REQUESTS_CLEANUP_MS) {
-      __signedRequestsCleanedAt = nowMs;
-      await client.query(FORGET_SIGNED_REQUESTS_SQL, [Math.floor(nowMs / 1000)]);
+    try {
+      return await recordSignedRequest(client, key, expiresAt);
+    } catch (error) {
+      if (!error || error.code !== UNDEFINED_TABLE_CODE) throw error;
+      await createSignedRequestsTable(client);
+      return recordSignedRequest(client, key, expiresAt);
     }
-    var taken = await client.query(TAKE_SIGNED_REQUEST_SQL, [key, expiresAt]);
-    return !!(taken && taken.rows && taken.rows[0]);
   });
 }
 

package/src/nodes/account/account-request-password-reset.ts

@@ -5,8 +5,9 @@ import { NodeHandlerGenerator, handlerToString } from '../types'
 // server: whether the address has an account, the link's token (minted there,
 // stored hashed), the page it opens and the email itself (provider, sender and
 // template baked from this node's config at generation). The route answers the
-// same whether the address has an account or not, so this node always reports
-// success for a well-formed request.
+// same whether the address has an account or not, so this node reports success
+// for a well-formed request unless the site could not keep a link, for any
+// address.
 async function account_request_password_reset(config: any, context: Record<string, unknown>) {
   const email = config && typeof config.email === 'string' ? config.email.trim() : ''
   if (!email) {

package/src/nodes/analytics/analytics-track-outcome.ts

@@ -14,6 +14,11 @@ import { NodeHandlerGenerator } from '../types'
  * carries the ids the trigger stamped on the context (`__tpa`, set by every
  * generated trigger) plus whatever first-touch snapshot the caller binds in
  * `attribution` (the checkout stamps `utm_*`, `referrer_host`, `landing_path`).
+ * A snapshot naming a `session_id` is the visit that placed an order, read back
+ * by a run outside that visit (a payment webhook, a cron, an admin page): its
+ * `session_id`, `visitor_id` and `exp` stand in for the trigger's ids. Otherwise
+ * the visitor id is the tracker's alone: a browser may still hold a persistent
+ * id from before its consent was withdrawn.
  *
  * Never throws: an outcome that cannot be reported answers `{ sent: false }`
  * and the workflow continues — analytics must never cost a sale.
@@ -60,22 +65,30 @@ const SERVER_BODY = `async function analytics_track_outcome(config, context) {
   if (baseUrl.indexOf('http') !== 0 || !publicKey || !serverKey) {
     return { sent: false, reason: 'not-configured' };
   }
+  // The service dedupes on this id and drops an outcome without one.
+  if (config.outcomeId == null || config.outcomeId === '') {
+    return { sent: false, reason: 'no-outcome-id' };
+  }
   var ids = context && context.__tpa && typeof context.__tpa === 'object' ? context.__tpa : {};
   var attribution = config.attribution && typeof config.attribution === 'object' ? config.attribution : {};
+  var visit = attribution.session_id
+    ? { sessionId: attribution.session_id, visitorId: attribution.visitor_id, exp: attribution.exp }
+    : ids;
   var outcome = {
     name: name,
     value: config.value == null || config.value === '' ? null : Number(config.value),
     currency: config.currency == null ? null : String(config.currency),
     outcomeId: config.outcomeId == null ? null : String(config.outcomeId),
     recordId: config.recordId == null ? null : String(config.recordId),
-    sessionId: ids.sessionId || null,
-    visitorId: ids.visitorId || attribution.visitor_id || null,
-    path: ids.path || null,
-    exp: ids.exp || null,
+    sessionId: visit.sessionId || null,
+    visitorId: visit.visitorId || null,
+    path: visit.path || null,
+    exp: visit.exp || null,
     attribution: {
       utmSource: attribution.utm_source || attribution.utmSource || null,
       utmMedium: attribution.utm_medium || attribution.utmMedium || null,
       utmCampaign: attribution.utm_campaign || attribution.utmCampaign || null,
+      utmContent: attribution.utm_content || attribution.utmContent || null,
       referrerHost: attribution.referrer_host || attribution.referrerHost || null,
       landingPath: attribution.landing_path || attribution.landingPath || null
     }

package/src/password-reset-route-generator.ts

@@ -55,6 +55,10 @@ export const DEFAULT_RESET_PAGE_PATH = '/reset-password'
 export const FORGOT_PASSWORD_ANSWER =
   'If an account exists for that email, we sent it a link to reset the password.'
 
+/** What the route answers, to every address, when a link could not be kept. */
+export const FORGOT_PASSWORD_NOT_SENT =
+  'We could not send the reset link. Please try again in a moment.'
+
 /**
  * The sessionStorage key the reset page reads the link's token from (mirrored
  * in teleport-gui `RESET_TOKEN_STORAGE_KEY`). The published site's first head
@@ -333,7 +337,9 @@ module.exports = async function handler(req, res) {
     return __security.sendClientError(res, 503, 'We could not reach the account service. Please try again in a moment.', err);
   }
 
+  var link = null;
   try {
+    await authUtils.ensurePasswordResetsUsable();
     // Counted for every address, with an account or without, so neither the
     // answer nor its timing differs.
     var recipient = await __security.rateLimit({
@@ -345,17 +351,20 @@ module.exports = async function handler(req, res) {
     if (user && userId != null && user.email && !recipient.allowed) {
       console.warn('[forgot-password] reset link not sent: this address was sent ${FORGOT_PASSWORD_RECIPIENT_LIMIT} in the last hour');
     } else if (user && userId != null && user.email) {
-      if (!authUtils.PASSWORD_RESET_SUPPORTED) {
-        console.warn('[forgot-password] reset link not sent: password reset needs a Postgres user store');
-      } else {
-        var token = crypto.randomBytes(32).toString('hex');
-        await authUtils.storePasswordReset(userId, sha256(token), TOKEN_TTL_SECONDS);
-        var resetUrl = trustedOrigin(req) + RESET_PAGE_PATH + TOKEN_LINK_PREFIX + token;
-        await sendResetEmail(user, resetUrl, token, __emailLocale.resolveRequestLocale(req));
-      }
+      var token = crypto.randomBytes(32).toString('hex');
+      await authUtils.storePasswordReset(userId, sha256(token), TOKEN_TTL_SECONDS);
+      link = { token: token, url: trustedOrigin(req) + RESET_PAGE_PATH + TOKEN_LINK_PREFIX + token };
     }
   } catch (err) {
-    console.error('[forgot-password] could not send a reset link:', err && err.message ? err.message : err);
+    await waitUntilElapsed(startedAt, MIN_RESPONSE_MS);
+    return __security.sendClientError(res, 503, ${JSON.stringify(FORGOT_PASSWORD_NOT_SENT)}, err);
+  }
+  if (link) {
+    try {
+      await sendResetEmail(user, link.url, link.token, __emailLocale.resolveRequestLocale(req));
+    } catch (err) {
+      console.error('[forgot-password] could not send a reset link:', err && err.message ? err.message : err);
+    }
   }
 
   await waitUntilElapsed(startedAt, MIN_RESPONSE_MS);

package/src/security-runtime/security-runtime-code.ts

@@ -38,8 +38,9 @@ export const securityRuntimeSpecifier = (relativePrefix: string): string =>
  *   itself, an IPv6 one its /64 (an IPv4 tail counted as the two groups it
  *   fills). Every rate limit keyed by visitor uses it.
  * - `rateLimit` counts fixed windows in the app's Postgres database (table
- *   `teleport_rate_limits`, created on first use under an advisory lock), so
- *   every instance of a serverless app counts together. Only an app with no
+ *   `teleport_rate_limits`, which the editor makes, created here under an
+ *   advisory lock only when it is really missing), so every instance of a
+ *   serverless app counts together. Only an app with no
  *   database (or no `pg` driver) counts in a bounded per-instance map; a
  *   database error counts in that map for a short while and is logged once.
  *   A request waits on the database at most 1.5 s; after a failure one
@@ -102,6 +103,9 @@ var CLEANUP_MAX_BATCHES = 3;
 var CLEANUP_QUERY_TIMEOUT_MS = 5000;
 var MEMORY_MAX_WINDOWS = 10000;
 
+// A site's database role may read and write its tables without being allowed
+// to create one, and CREATE ... IF NOT EXISTS asks for that permission even when
+// the table is there: these run only for a table that really is missing.
 var CREATE_SQL = 'CREATE TABLE IF NOT EXISTS "' + RATE_LIMITS_TABLE + '" (' +
   '"key" TEXT NOT NULL, "window_start" BIGINT NOT NULL, "count" INTEGER NOT NULL DEFAULT 0, ' +
   '"expires_at" BIGINT NOT NULL, PRIMARY KEY ("key", "window_start"))';
@@ -298,7 +302,6 @@ function __memoryHit(storageKey, windowStart, windowSeconds, nowSec) {
   return entry.count;
 }
 
-var __tableReady = false;
 // Healthy, every request asks the database. After a failure, requests count in
 // memory until __databaseRetryAt; then ONE request probes (it pushes the retry
 // time back before it asks), so the requests beside it never wait on a
@@ -377,12 +380,15 @@ async function __databaseHit(storageKey, windowStart, expiresAt, nowSec) {
     return within(client.query(sql, values || []), QUERY_TIMEOUT_MS);
   };
   var createTable = async function () {
-    await run('BEGIN');
-    await run(LOCK_SQL, [RATE_LIMITS_TABLE]);
-    await run(CREATE_SQL);
-    await run(INDEX_SQL);
-    await run('COMMIT');
-    __tableReady = true;
+    try {
+      await run('BEGIN');
+      await run(LOCK_SQL, [RATE_LIMITS_TABLE]);
+      await run(CREATE_SQL);
+      await run(INDEX_SQL);
+      await run('COMMIT');
+    } catch (err) {
+      throw new Error('the table ' + RATE_LIMITS_TABLE + ' is missing and could not be created: ' + __errorText(err));
+    }
   };
   var hit = function () {
     return run(HIT_SQL, [storageKey, windowStart, expiresAt]);
@@ -390,15 +396,13 @@ async function __databaseHit(storageKey, windowStart, expiresAt, nowSec) {
   var handedToCleanup = false;
   try {
     await within(client.connect(), CONNECT_TIMEOUT_MS);
-    if (!__tableReady) await createTable();
     var result;
     try {
       result = await hit();
     } catch (err) {
-      // The table went away (dropped, or the database restored from an
-      // older backup): create it again and count this request in it.
+      // The table is not there (dropped, or the database restored from an
+      // older backup): create it and count this request in it.
       if (!err || err.code !== '42P01') throw err;
-      __tableReady = false;
       await createTable();
       result = await hit();
     }