@teleporthq/teleport-plugin-next-workflows 0.45.2 → 0.45.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teleporthq/teleport-plugin-next-workflows",
-  "version": "0.45.2",
+  "version": "0.45.5",
   "description": "A plugin for workflow code generation in Next.js projects.",
   "author": "teleportHQ",
   "license": "MIT",
@@ -69,5 +69,5 @@
     "@teleporthq/teleport-shared": "^0.45.0",
     "@teleporthq/teleport-types": "^0.45.0"
   },
-  "gitHead": "3be925a09c56ec0afe44940a623cbfcc54e5170f"
+  "gitHead": "3af9d41f936652db5b37d0a40ebcc78bdfd685a5"
 }

package/src/api-route-generator.ts

@@ -14,7 +14,12 @@ import { isCostBearingNodeType } from './nodes/cost-bearing-node-types'
 import { nodeRegistry } from './nodes'
 import { NodeHandlerGenerator, ServerHandlerOptions, resolveHandlerEntryName } from './nodes/types'
 import { generalWait } from './nodes/general/general-wait'
-import { needsVisitorRequest, VISITOR_REQUEST_INJECTION } from './nodes/general/visitor-request'
+import {
+  isOutboundMessageNodeType,
+  needsVisitorRequest,
+  VISITOR_REQUEST_INJECTION,
+} from './nodes/general/visitor-request'
+import { stepNameOf } from './nodes/email/message-trust'
 import {
   markVisitorBoundMessageNodes,
   markWebhookMessageNodes,
@@ -2180,6 +2185,33 @@ const generateErrorHandlerRunBlock = (
       }
     }`
 
+/**
+ * The email and SMS steps a run of this automation can report as not having
+ * sent. None when it could not tell: a custom node may send by itself, and a
+ * parallel branch the run does not wait for has no result when the run ends.
+ * Steps on the error branch do not count: a run that ends well never reaches them.
+ */
+const reportableSendSteps = (
+  workflow: UIDLWorkflow,
+  errorHandlerNodes: Array<{ id: string }> | null
+): Array<{ id: string; label: string }> => {
+  const nodes = workflow.nodes || []
+  const couldNotTell = nodes.some(
+    (node) =>
+      node.type === 'general-custom-node' ||
+      (node.type === 'general-parallel' &&
+        node.config?.waitForAll !== undefined &&
+        node.config.waitForAll !== true)
+  )
+  if (couldNotTell) {
+    return []
+  }
+  const errorBranch = new Set((errorHandlerNodes || []).map((node) => node.id))
+  return nodes
+    .filter((node) => isOutboundMessageNodeType(node.type) && !errorBranch.has(node.id))
+    .map((node) => ({ id: node.id, label: stepNameOf(node) }))
+}
+
 /**
  * An automation's handler module (`lib/automations/handlers/<file>.js`, see
  * automations/handler-module-generator.ts): the webhook route's node loop as
@@ -2199,6 +2231,8 @@ const generateErrorHandlerRunBlock = (
  * nothing and resolves `{ waiting: true, wouldWait }`; a Wait with no step
  * after it stores nothing and the run ends there). A run that fails rejects,
  * after the error-handler branch ran, so the dispatcher records the failure.
+ * A run that ends with its email and SMS steps all unsent resolves with their
+ * names under `sentNothing`, so the History can say so instead of Done.
  */
 export const generateHandlerFunction = (
   workflow: UIDLWorkflow,
@@ -2277,6 +2311,8 @@ const WORKFLOW_CONFIG = ${workflowConfig};
 
 var ERROR_HANDLER_NODES = ${errorHandlerNodesJson};
 
+var SEND_STEPS = ${JSON.stringify(reportableSendSteps(workflow, errorHandlerNodes))};
+
 const nodeHandlers = {
 ${nodeHandlersEntries}
 };
@@ -2318,6 +2354,17 @@ ${executionLoop}
     return { waiting: false };
 }
 
+// The names of the send steps when the run has some and none of them sent: a
+// step a condition skipped has no result, one that failed and went on says so.
+function unsentSendSteps(context) {
+  if (SEND_STEPS.length === 0) return null;
+  var sent = SEND_STEPS.some(function(step) {
+    var result = context[step.id];
+    return !!result && !utils.isFatalNodeResult(result);
+  });
+  return sent ? null : SEND_STEPS.map(function(step) { return step.label; });
+}
+
 async function run(event, context, resumeFrom) {
   context = context && typeof context === 'object' ? context : {};
   // Shared fire-and-forget queue — drained before the run settles.
@@ -2350,13 +2397,16 @@ async function run(event, context, resumeFrom) {
     sourceRef: WORKFLOW_ID,
     orderId: trigger.order && trigger.order.id ? String(trigger.order.id) : null,
   };
+  var outcome;
   try {
-    return await runNodes(context, resumeFrom || null);
+    outcome = await runNodes(context, resumeFrom || null);
   } catch (error) {
 ${generateErrorHandlerRunBlock('Automation error handler failed:')}
     await utils.settlePendingNodePromises(context);
     throw error;
   }
+  var unsent = outcome.waiting ? null : unsentSendSteps(context);
+  return unsent ? Object.assign({}, outcome, { sentNothing: unsent }) : outcome;
 }
 
 module.exports.run = run;

package/src/auth-generator.ts

@@ -730,13 +730,15 @@ export const PASSWORD_RESETS_TABLE = 'teleport_password_resets'
 const PG_PASSWORD_RESET_FUNCTIONS = `
 // Password-reset links (pages/api/auth/forgot-password + reset-password). Only
 // the SHA-256 of a link's token is stored, bound to the account id, with its
-// expiry; the table is created on first use. The earlier password_reset_tokens
-// table and its rows are never read.
+// expiry. The editor makes the table with the other account tables, and a site's
+// database role may read and write it without being allowed to create one
+// (CREATE ... IF NOT EXISTS asks for that permission even when the table is
+// there), so a create is attempted only for a table that really is missing. The
+// earlier password_reset_tokens table and its rows are never read.
 var PASSWORD_RESETS_TABLE = '${PASSWORD_RESETS_TABLE}';
-var __passwordResetsTableReady = false;
+var UNDEFINED_TABLE_CODE = '42P01';
 
-async function ensurePasswordResetsTable(client) {
-  if (__passwordResetsTableReady) return;
+async function createPasswordResetsTable(client) {
   await client.query('BEGIN');
   try {
     await client.query('SELECT pg_advisory_xact_lock(hashtext($1))', [PASSWORD_RESETS_TABLE]);
@@ -748,28 +750,53 @@ async function ensurePasswordResetsTable(client) {
     await client.query('COMMIT');
   } catch (err) {
     try { await client.query('ROLLBACK'); } catch (_e) {}
-    throw err;
+    throw new Error('[password-reset] the table ' + PASSWORD_RESETS_TABLE + ' is missing and could not be created: ' + (err && err.message ? err.message : String(err)));
+  }
+}
+
+// Throws when a link could not be kept. Asked for every address, with an account
+// or without, so a table that cannot be used refuses them all alike.
+async function ensurePasswordResetsUsable() {
+  const client = getClient();
+  try {
+    await client.connect();
+    try {
+      await client.query('SELECT 1 FROM ' + PASSWORD_RESETS_TABLE + ' LIMIT 1');
+    } catch (err) {
+      if (!err || err.code !== UNDEFINED_TABLE_CODE) throw err;
+      await createPasswordResetsTable(client);
+    }
+  } finally {
+    try { await client.end(); } catch (_e) {}
   }
-  __passwordResetsTableReady = true;
 }
 
 // One live link per account: a new one ends the ones sent before it.
+async function writePasswordReset(client, userId, tokenHash, ttlSeconds) {
+  await client.query(
+    'UPDATE ' + PASSWORD_RESETS_TABLE + ' SET used_at = NOW() WHERE user_id = $1 AND used_at IS NULL',
+    [String(userId)]
+  );
+  await client.query(
+    'INSERT INTO ' + PASSWORD_RESETS_TABLE + " (token_hash, user_id, expires_at) VALUES ($1, $2, NOW() + ($3::int * INTERVAL '1 second'))",
+    [tokenHash, String(userId), ttlSeconds]
+  );
+  await client.query(
+    'DELETE FROM ' + PASSWORD_RESETS_TABLE + " WHERE expires_at < NOW() - INTERVAL '1 day'"
+  );
+}
+
 async function storePasswordReset(userId, tokenHash, ttlSeconds) {
   const client = getClient();
   try {
     await client.connect();
-    await ensurePasswordResetsTable(client);
-    await client.query(
-      'UPDATE ' + PASSWORD_RESETS_TABLE + ' SET used_at = NOW() WHERE user_id = $1 AND used_at IS NULL',
-      [String(userId)]
-    );
-    await client.query(
-      'INSERT INTO ' + PASSWORD_RESETS_TABLE + " (token_hash, user_id, expires_at) VALUES ($1, $2, NOW() + ($3::int * INTERVAL '1 second'))",
-      [tokenHash, String(userId), ttlSeconds]
-    );
-    await client.query(
-      'DELETE FROM ' + PASSWORD_RESETS_TABLE + " WHERE expires_at < NOW() - INTERVAL '1 day'"
-    );
+    try {
+      await writePasswordReset(client, userId, tokenHash, ttlSeconds);
+    } catch (err) {
+      if (!err || err.code !== UNDEFINED_TABLE_CODE) throw err;
+      await createPasswordResetsTable(client);
+      await writePasswordReset(client, userId, tokenHash, ttlSeconds);
+    }
   } finally {
     try { await client.end(); } catch (_e) {}
   }
@@ -825,6 +852,7 @@ const PASSWORD_RESET_SUPPORTED = true;`
 const UNSUPPORTED_PASSWORD_RESET_FUNCTIONS = `
 // Password-reset links need a Postgres database; this project's user store is
 // not one, so the reset routes answer without ever sending a link.
+async function ensurePasswordResetsUsable() { throw new Error('Password reset needs a Postgres database'); }
 async function storePasswordReset() { throw new Error('Password reset needs a Postgres database'); }
 async function consumePasswordReset() { return null; }
 async function passwordResetIsLive() { return false; }
@@ -1349,6 +1377,7 @@ ${
 module.exports.checkSignInAllowed = checkSignInAllowed;
 module.exports.countSignInFailure = countSignInFailure;
 module.exports.SIGN_IN_VISITOR_HEADER = SIGN_IN_VISITOR_HEADER;
+module.exports.ensurePasswordResetsUsable = ensurePasswordResetsUsable;
 module.exports.storePasswordReset = storePasswordReset;
 module.exports.consumePasswordReset = consumePasswordReset;
 module.exports.passwordResetIsLive = passwordResetIsLive;

package/src/automations/dispatcher-source.ts

@@ -361,6 +361,14 @@ function runStatus(error, value) {
   return value && value.waiting === true ? 'waiting' : 'delivered';
 }
 
+// What a run leaves in its delivery's error column: its error, or, for a run
+// that finished, the send steps that did not send. Its status says nothing of
+// them: such a run is delivered, and is neither retried nor counted as failed.
+function runNote(error, value) {
+  if (error) return store.errorMessage(error);
+  return value && value.sentNothing ? JSON.stringify({ sentNothing: value.sentNothing }) : null;
+}
+
 // Whether a guarded write found its row (the claim it names still held it).
 function wrote(result) {
   return !!result && result.rowCount > 0;
@@ -368,7 +376,7 @@ function wrote(result) {
 
 function lateDeliveryWriter(delivery, testRun, resumePoint) {
   return function (error, value) {
-    var message = error ? store.errorMessage(error) : null;
+    var message = runNote(error, value);
     var status = testRun ? 'test' : runStatus(error, value);
     store.withClient(async function (client) {
       var finished = await client.query(FINISH_DELIVERY_SQL, [delivery.id, status, message, delivery.attempts]);
@@ -386,7 +394,7 @@ function lateWaitWriter(wait, resumedAt) {
     // Nothing is written once another dispatcher took the stale resume over:
     // that run records the outcome.
     store.withClient(function (client) {
-      return finishResume(client, wait, runStatus(error, value), error ? store.errorMessage(error) : null, resumedAt);
+      return finishResume(client, wait, runStatus(error, value), runNote(error, value), resumedAt);
     }).catch(function (writeError) {
       console.error('[automations] could not record a late resume: ' + store.errorMessage(writeError));
     });
@@ -624,7 +632,7 @@ async function deliverEvent(client, row, context) {
     var error = ran.error ? store.errorMessage(ran.error) : null;
     if (error) console.error('[automations] ' + entry.name + ' failed for event ' + row.id + ': ' + error);
     // A run that stopped at a Wait is not finished: its delivery waits too.
-    var finished = await client.query(FINISH_DELIVERY_SQL, [delivery.id, runStatus(ran.error, ran.value), error, delivery.attempts]);
+    var finished = await client.query(FINISH_DELIVERY_SQL, [delivery.id, runStatus(ran.error, ran.value), runNote(ran.error, ran.value), delivery.attempts]);
     if (resumePoint && !error && wrote(finished)) await client.query(SETTLE_FAILED_WAIT_SQL, [resumePoint.id]);
     if (error) outcome.failed += 1;
     else outcome.delivered += 1;
@@ -690,7 +698,7 @@ async function resumeWaits(client, context) {
       wait,
       eventRow,
       runStatus(ran.error, ran.value),
-      ran.error ? store.errorMessage(ran.error) : null,
+      runNote(ran.error, ran.value),
       resumedAt
     );
   }
@@ -834,7 +842,7 @@ async function runTest(input, options) {
     }, timeoutMs, lateDeliveryWriter(delivery, true));
     if (ran.timedOut) return totals;
     var wouldWait = ran.value && ran.value.wouldWait ? ran.value.wouldWait : null;
-    var note = ran.error ? store.errorMessage(ran.error) : wouldWait ? JSON.stringify({ wouldWait: wouldWait }) : null;
+    var note = wouldWait ? JSON.stringify({ wouldWait: wouldWait }) : runNote(ran.error, ran.value);
     await client.query(FINISH_DELIVERY_SQL, [delivery.id, 'test', note, delivery.attempts]);
     if (ran.error) totals.failed = 1;
     else totals.delivered = 1;

package/src/automations/event-bus-source.ts

@@ -89,10 +89,15 @@ async function saveWait(wait) {
 
 // The signed requests the dispatch route has taken, each kept until its
 // signature can no longer verify: the same request again is refused. The
-// table (and its expiry index) is made on first use, two instances taking
-// turns under the lock. The rows that are over are deleted at most once per
-// instance every SIGNED_REQUESTS_CLEANUP_MS, a bounded batch at a time.
+// editor makes the table with the other automation tables, and a site's
+// database role may read and write it without being allowed to create one
+// (CREATE ... IF NOT EXISTS asks for that permission even when the table is
+// there), so a create is attempted only for a table that really is missing,
+// two instances taking turns under the lock. The rows that are over are
+// deleted at most once per instance every SIGNED_REQUESTS_CLEANUP_MS, a
+// bounded batch at a time.
 var SIGNED_REQUESTS_TABLE = '${SIGNED_REQUESTS_TABLE}';
+var UNDEFINED_TABLE_CODE = '42P01';
 var LOCK_SIGNED_REQUESTS_SQL = 'SELECT pg_advisory_xact_lock(hashtext($1))';
 var CREATE_SIGNED_REQUESTS_SQL = 'CREATE TABLE IF NOT EXISTS ' + SIGNED_REQUESTS_TABLE +
   ' (request_key TEXT PRIMARY KEY, expires_at BIGINT NOT NULL)';
@@ -103,34 +108,43 @@ var FORGET_SIGNED_REQUESTS_SQL = 'DELETE FROM ' + SIGNED_REQUESTS_TABLE + ' WHER
 var TAKE_SIGNED_REQUEST_SQL = 'INSERT INTO ' + SIGNED_REQUESTS_TABLE + ' (request_key, expires_at) VALUES ($1, $2) ' +
   'ON CONFLICT (request_key) DO NOTHING RETURNING request_key';
 var SIGNED_REQUESTS_CLEANUP_MS = 600000;
-var __signedRequestsReady = false;
 var __signedRequestsCleanedAt = 0;
 
+async function createSignedRequestsTable(client) {
+  await client.query('BEGIN');
+  try {
+    await client.query(LOCK_SIGNED_REQUESTS_SQL, [SIGNED_REQUESTS_TABLE]);
+    await client.query(CREATE_SIGNED_REQUESTS_SQL);
+    await client.query(INDEX_SIGNED_REQUESTS_SQL);
+    await client.query('COMMIT');
+  } catch (error) {
+    try { await client.query('ROLLBACK'); } catch (_e) {}
+    throw new Error('[automations] the table ' + SIGNED_REQUESTS_TABLE + ' is missing and could not be created: ' + errorMessage(error));
+  }
+}
+
+async function recordSignedRequest(client, key, expiresAt) {
+  var nowMs = Date.now();
+  if (nowMs - __signedRequestsCleanedAt >= SIGNED_REQUESTS_CLEANUP_MS) {
+    __signedRequestsCleanedAt = nowMs;
+    await client.query(FORGET_SIGNED_REQUESTS_SQL, [Math.floor(nowMs / 1000)]);
+  }
+  var taken = await client.query(TAKE_SIGNED_REQUEST_SQL, [key, expiresAt]);
+  return !!(taken && taken.rows && taken.rows[0]);
+}
+
 // true the first time a signed request (its key) is taken, false every time
 // after while it is kept (until expiresAt, unix seconds). Throws when the
 // database cannot say: the route then refuses.
 async function takeSignedRequest(key, expiresAt) {
   return withClient(async function (client) {
-    if (!__signedRequestsReady) {
-      await client.query('BEGIN');
-      try {
-        await client.query(LOCK_SIGNED_REQUESTS_SQL, [SIGNED_REQUESTS_TABLE]);
-        await client.query(CREATE_SIGNED_REQUESTS_SQL);
-        await client.query(INDEX_SIGNED_REQUESTS_SQL);
-        await client.query('COMMIT');
-      } catch (error) {
-        try { await client.query('ROLLBACK'); } catch (_e) {}
-        throw error;
-      }
-      __signedRequestsReady = true;
-    }
-    var nowMs = Date.now();
-    if (nowMs - __signedRequestsCleanedAt >= SIGNED_REQUESTS_CLEANUP_MS) {
-      __signedRequestsCleanedAt = nowMs;
-      await client.query(FORGET_SIGNED_REQUESTS_SQL, [Math.floor(nowMs / 1000)]);
+    try {
+      return await recordSignedRequest(client, key, expiresAt);
+    } catch (error) {
+      if (!error || error.code !== UNDEFINED_TABLE_CODE) throw error;
+      await createSignedRequestsTable(client);
+      return recordSignedRequest(client, key, expiresAt);
     }
-    var taken = await client.query(TAKE_SIGNED_REQUEST_SQL, [key, expiresAt]);
-    return !!(taken && taken.rows && taken.rows[0]);
   });
 }
 

package/src/executor-generator.ts

@@ -1008,6 +1008,9 @@ async function executeWorkflow(workflowConfig, triggerContext, nodeHandlers, opt
   if (triggerContext && triggerContext.__dynamicRouteParam) {
     context.__dynamicRouteParam = triggerContext.__dynamicRouteParam;
   }
+  if (triggerContext && triggerContext.__tpa) {
+    context.__tpa = triggerContext.__tpa;
+  }
   if (triggerContext && triggerContext.triggerElement) {
     context.triggerElement = triggerContext.triggerElement;
   }
@@ -2151,6 +2154,7 @@ function buildContext(workflowConfig, triggerContext) {
     if (triggerContext.__stateValues) context.__stateValues = triggerContext.__stateValues;
     if (triggerContext.__routeParams) context.__routeParams = triggerContext.__routeParams;
     if (triggerContext.__dynamicRouteParam) context.__dynamicRouteParam = triggerContext.__dynamicRouteParam;
+    if (triggerContext.__tpa) context.__tpa = triggerContext.__tpa;
     if (triggerContext.triggerElement) context.triggerElement = triggerContext.triggerElement;
   }
   // See executeWorkflow: the page's language travels with the run.

package/src/nodes/account/account-request-password-reset.ts

@@ -5,8 +5,9 @@ import { NodeHandlerGenerator, handlerToString } from '../types'
 // server: whether the address has an account, the link's token (minted there,
 // stored hashed), the page it opens and the email itself (provider, sender and
 // template baked from this node's config at generation). The route answers the
-// same whether the address has an account or not, so this node always reports
-// success for a well-formed request.
+// same whether the address has an account or not, so this node reports success
+// for a well-formed request unless the site could not keep a link, for any
+// address.
 async function account_request_password_reset(config: any, context: Record<string, unknown>) {
   const email = config && typeof config.email === 'string' ? config.email.trim() : ''
   if (!email) {

package/src/nodes/analytics/analytics-track-outcome.ts

@@ -14,6 +14,11 @@ import { NodeHandlerGenerator } from '../types'
  * carries the ids the trigger stamped on the context (`__tpa`, set by every
  * generated trigger) plus whatever first-touch snapshot the caller binds in
  * `attribution` (the checkout stamps `utm_*`, `referrer_host`, `landing_path`).
+ * A snapshot naming a `session_id` is the visit that placed an order, read back
+ * by a run outside that visit (a payment webhook, a cron, an admin page): its
+ * `session_id`, `visitor_id` and `exp` stand in for the trigger's ids. Otherwise
+ * the visitor id is the tracker's alone: a browser may still hold a persistent
+ * id from before its consent was withdrawn.
  *
  * Never throws: an outcome that cannot be reported answers `{ sent: false }`
  * and the workflow continues — analytics must never cost a sale.
@@ -60,22 +65,30 @@ const SERVER_BODY = `async function analytics_track_outcome(config, context) {
   if (baseUrl.indexOf('http') !== 0 || !publicKey || !serverKey) {
     return { sent: false, reason: 'not-configured' };
   }
+  // The service dedupes on this id and drops an outcome without one.
+  if (config.outcomeId == null || config.outcomeId === '') {
+    return { sent: false, reason: 'no-outcome-id' };
+  }
   var ids = context && context.__tpa && typeof context.__tpa === 'object' ? context.__tpa : {};
   var attribution = config.attribution && typeof config.attribution === 'object' ? config.attribution : {};
+  var visit = attribution.session_id
+    ? { sessionId: attribution.session_id, visitorId: attribution.visitor_id, exp: attribution.exp }
+    : ids;
   var outcome = {
     name: name,
     value: config.value == null || config.value === '' ? null : Number(config.value),
     currency: config.currency == null ? null : String(config.currency),
     outcomeId: config.outcomeId == null ? null : String(config.outcomeId),
     recordId: config.recordId == null ? null : String(config.recordId),
-    sessionId: ids.sessionId || null,
-    visitorId: ids.visitorId || attribution.visitor_id || null,
-    path: ids.path || null,
-    exp: ids.exp || null,
+    sessionId: visit.sessionId || null,
+    visitorId: visit.visitorId || null,
+    path: visit.path || null,
+    exp: visit.exp || null,
     attribution: {
       utmSource: attribution.utm_source || attribution.utmSource || null,
       utmMedium: attribution.utm_medium || attribution.utmMedium || null,
       utmCampaign: attribution.utm_campaign || attribution.utmCampaign || null,
+      utmContent: attribution.utm_content || attribution.utmContent || null,
       referrerHost: attribution.referrer_host || attribution.referrerHost || null,
       landingPath: attribution.landing_path || attribution.landingPath || null
     }

package/src/password-reset-route-generator.ts

@@ -55,6 +55,10 @@ export const DEFAULT_RESET_PAGE_PATH = '/reset-password'
 export const FORGOT_PASSWORD_ANSWER =
   'If an account exists for that email, we sent it a link to reset the password.'
 
+/** What the route answers, to every address, when a link could not be kept. */
+export const FORGOT_PASSWORD_NOT_SENT =
+  'We could not send the reset link. Please try again in a moment.'
+
 /**
  * The sessionStorage key the reset page reads the link's token from (mirrored
  * in teleport-gui `RESET_TOKEN_STORAGE_KEY`). The published site's first head
@@ -333,7 +337,9 @@ module.exports = async function handler(req, res) {
     return __security.sendClientError(res, 503, 'We could not reach the account service. Please try again in a moment.', err);
   }
 
+  var link = null;
   try {
+    await authUtils.ensurePasswordResetsUsable();
     // Counted for every address, with an account or without, so neither the
     // answer nor its timing differs.
     var recipient = await __security.rateLimit({
@@ -345,17 +351,20 @@ module.exports = async function handler(req, res) {
     if (user && userId != null && user.email && !recipient.allowed) {
       console.warn('[forgot-password] reset link not sent: this address was sent ${FORGOT_PASSWORD_RECIPIENT_LIMIT} in the last hour');
     } else if (user && userId != null && user.email) {
-      if (!authUtils.PASSWORD_RESET_SUPPORTED) {
-        console.warn('[forgot-password] reset link not sent: password reset needs a Postgres user store');
-      } else {
-        var token = crypto.randomBytes(32).toString('hex');
-        await authUtils.storePasswordReset(userId, sha256(token), TOKEN_TTL_SECONDS);
-        var resetUrl = trustedOrigin(req) + RESET_PAGE_PATH + TOKEN_LINK_PREFIX + token;
-        await sendResetEmail(user, resetUrl, token, __emailLocale.resolveRequestLocale(req));
-      }
+      var token = crypto.randomBytes(32).toString('hex');
+      await authUtils.storePasswordReset(userId, sha256(token), TOKEN_TTL_SECONDS);
+      link = { token: token, url: trustedOrigin(req) + RESET_PAGE_PATH + TOKEN_LINK_PREFIX + token };
     }
   } catch (err) {
-    console.error('[forgot-password] could not send a reset link:', err && err.message ? err.message : err);
+    await waitUntilElapsed(startedAt, MIN_RESPONSE_MS);
+    return __security.sendClientError(res, 503, ${JSON.stringify(FORGOT_PASSWORD_NOT_SENT)}, err);
+  }
+  if (link) {
+    try {
+      await sendResetEmail(user, link.url, link.token, __emailLocale.resolveRequestLocale(req));
+    } catch (err) {
+      console.error('[forgot-password] could not send a reset link:', err && err.message ? err.message : err);
+    }
   }
 
   await waitUntilElapsed(startedAt, MIN_RESPONSE_MS);

package/src/security-runtime/security-runtime-code.ts

@@ -38,8 +38,9 @@ export const securityRuntimeSpecifier = (relativePrefix: string): string =>
  *   itself, an IPv6 one its /64 (an IPv4 tail counted as the two groups it
  *   fills). Every rate limit keyed by visitor uses it.
  * - `rateLimit` counts fixed windows in the app's Postgres database (table
- *   `teleport_rate_limits`, created on first use under an advisory lock), so
- *   every instance of a serverless app counts together. Only an app with no
+ *   `teleport_rate_limits`, which the editor makes, created here under an
+ *   advisory lock only when it is really missing), so every instance of a
+ *   serverless app counts together. Only an app with no
  *   database (or no `pg` driver) counts in a bounded per-instance map; a
  *   database error counts in that map for a short while and is logged once.
  *   A request waits on the database at most 1.5 s; after a failure one
@@ -102,6 +103,9 @@ var CLEANUP_MAX_BATCHES = 3;
 var CLEANUP_QUERY_TIMEOUT_MS = 5000;
 var MEMORY_MAX_WINDOWS = 10000;
 
+// A site's database role may read and write its tables without being allowed
+// to create one, and CREATE ... IF NOT EXISTS asks for that permission even when
+// the table is there: these run only for a table that really is missing.
 var CREATE_SQL = 'CREATE TABLE IF NOT EXISTS "' + RATE_LIMITS_TABLE + '" (' +
   '"key" TEXT NOT NULL, "window_start" BIGINT NOT NULL, "count" INTEGER NOT NULL DEFAULT 0, ' +
   '"expires_at" BIGINT NOT NULL, PRIMARY KEY ("key", "window_start"))';
@@ -298,7 +302,6 @@ function __memoryHit(storageKey, windowStart, windowSeconds, nowSec) {
   return entry.count;
 }
 
-var __tableReady = false;
 // Healthy, every request asks the database. After a failure, requests count in
 // memory until __databaseRetryAt; then ONE request probes (it pushes the retry
 // time back before it asks), so the requests beside it never wait on a
@@ -377,12 +380,15 @@ async function __databaseHit(storageKey, windowStart, expiresAt, nowSec) {
     return within(client.query(sql, values || []), QUERY_TIMEOUT_MS);
   };
   var createTable = async function () {
-    await run('BEGIN');
-    await run(LOCK_SQL, [RATE_LIMITS_TABLE]);
-    await run(CREATE_SQL);
-    await run(INDEX_SQL);
-    await run('COMMIT');
-    __tableReady = true;
+    try {
+      await run('BEGIN');
+      await run(LOCK_SQL, [RATE_LIMITS_TABLE]);
+      await run(CREATE_SQL);
+      await run(INDEX_SQL);
+      await run('COMMIT');
+    } catch (err) {
+      throw new Error('the table ' + RATE_LIMITS_TABLE + ' is missing and could not be created: ' + __errorText(err));
+    }
   };
   var hit = function () {
     return run(HIT_SQL, [storageKey, windowStart, expiresAt]);
@@ -390,15 +396,13 @@ async function __databaseHit(storageKey, windowStart, expiresAt, nowSec) {
   var handedToCleanup = false;
   try {
     await within(client.connect(), CONNECT_TIMEOUT_MS);
-    if (!__tableReady) await createTable();
     var result;
     try {
       result = await hit();
     } catch (err) {
-      // The table went away (dropped, or the database restored from an
-      // older backup): create it again and count this request in it.
+      // The table is not there (dropped, or the database restored from an
+      // older backup): create it and count this request in it.
       if (!err || err.code !== '42P01') throw err;
-      __tableReady = false;
       await createTable();
       result = await hit();
     }