@teleporthq/teleport-plugin-next-workflows 0.45.4 → 0.45.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teleporthq/teleport-plugin-next-workflows",
-  "version": "0.45.4",
+  "version": "0.45.6",
   "description": "A plugin for workflow code generation in Next.js projects.",
   "author": "teleportHQ",
   "license": "MIT",
@@ -69,5 +69,5 @@
     "@teleporthq/teleport-shared": "^0.45.0",
     "@teleporthq/teleport-types": "^0.45.0"
   },
-  "gitHead": "4fc86526c794a1304f0298809bf3530b4d380486"
+  "gitHead": "c31e265b69774868545e810e31a3c748f62a1729"
 }

package/src/account-delete-route-generator.ts

@@ -335,19 +335,28 @@ function readRequestPassword(req) {
   return String(body.password);
 }
 
-// The sign-in check (utils/auth/hash-password.js verifyPassword): bcrypt over
-// the SHA-256 of the password and AUTH_PEPPER. An account without a stored
-// password (a social sign-in) matches no password.
+// The sign-in check (utils/auth/hash-password.js checkPassword): bcrypt over
+// the SHA-256 of the password and a pepper, the project's own
+// (AUTH_PEPPER_SECRET) first, then the one every earlier hash used
+// (AUTH_PEPPER). An account without a stored password (a social sign-in)
+// matches no password.
 function passwordMatches(password, storedHash) {
   if (!storedHash || password.length > 1000) { return false; }
   var bcrypt = require('bcryptjs');
   var crypto = require('crypto');
-  var prepared = crypto.createHash('sha256').update(password + (process.env.AUTH_PEPPER || '')).digest('base64');
-  try {
-    return bcrypt.compareSync(prepared, String(storedHash));
-  } catch (e) {
-    return false;
+  var secret = process.env.AUTH_PEPPER_SECRET;
+  var peppers = typeof secret === 'string' && secret && secret.indexOf('teleporthq.secrets.') !== 0
+    ? [secret, process.env.AUTH_PEPPER || '']
+    : [process.env.AUTH_PEPPER || ''];
+  for (var i = 0; i < peppers.length; i++) {
+    var prepared = crypto.createHash('sha256').update(password + peppers[i]).digest('base64');
+    try {
+      if (bcrypt.compareSync(prepared, String(storedHash))) { return true; }
+    } catch (e) {
+      return false;
+    }
   }
+  return false;
 }
 
 ${generateFillTemplateFn()}

package/src/api-route-generator.ts

@@ -14,7 +14,12 @@ import { isCostBearingNodeType } from './nodes/cost-bearing-node-types'
 import { nodeRegistry } from './nodes'
 import { NodeHandlerGenerator, ServerHandlerOptions, resolveHandlerEntryName } from './nodes/types'
 import { generalWait } from './nodes/general/general-wait'
-import { needsVisitorRequest, VISITOR_REQUEST_INJECTION } from './nodes/general/visitor-request'
+import {
+  isOutboundMessageNodeType,
+  needsVisitorRequest,
+  VISITOR_REQUEST_INJECTION,
+} from './nodes/general/visitor-request'
+import { stepNameOf } from './nodes/email/message-trust'
 import {
   markVisitorBoundMessageNodes,
   markWebhookMessageNodes,
@@ -2180,6 +2185,33 @@ const generateErrorHandlerRunBlock = (
       }
     }`
 
+/**
+ * The email and SMS steps a run of this automation can report as not having
+ * sent. None when it could not tell: a custom node may send by itself, and a
+ * parallel branch the run does not wait for has no result when the run ends.
+ * Steps on the error branch do not count: a run that ends well never reaches them.
+ */
+const reportableSendSteps = (
+  workflow: UIDLWorkflow,
+  errorHandlerNodes: Array<{ id: string }> | null
+): Array<{ id: string; label: string }> => {
+  const nodes = workflow.nodes || []
+  const couldNotTell = nodes.some(
+    (node) =>
+      node.type === 'general-custom-node' ||
+      (node.type === 'general-parallel' &&
+        node.config?.waitForAll !== undefined &&
+        node.config.waitForAll !== true)
+  )
+  if (couldNotTell) {
+    return []
+  }
+  const errorBranch = new Set((errorHandlerNodes || []).map((node) => node.id))
+  return nodes
+    .filter((node) => isOutboundMessageNodeType(node.type) && !errorBranch.has(node.id))
+    .map((node) => ({ id: node.id, label: stepNameOf(node) }))
+}
+
 /**
  * An automation's handler module (`lib/automations/handlers/<file>.js`, see
  * automations/handler-module-generator.ts): the webhook route's node loop as
@@ -2199,6 +2231,8 @@ const generateErrorHandlerRunBlock = (
  * nothing and resolves `{ waiting: true, wouldWait }`; a Wait with no step
  * after it stores nothing and the run ends there). A run that fails rejects,
  * after the error-handler branch ran, so the dispatcher records the failure.
+ * A run that ends with its email and SMS steps all unsent resolves with their
+ * names under `sentNothing`, so the History can say so instead of Done.
  */
 export const generateHandlerFunction = (
   workflow: UIDLWorkflow,
@@ -2277,6 +2311,8 @@ const WORKFLOW_CONFIG = ${workflowConfig};
 
 var ERROR_HANDLER_NODES = ${errorHandlerNodesJson};
 
+var SEND_STEPS = ${JSON.stringify(reportableSendSteps(workflow, errorHandlerNodes))};
+
 const nodeHandlers = {
 ${nodeHandlersEntries}
 };
@@ -2318,6 +2354,17 @@ ${executionLoop}
     return { waiting: false };
 }
 
+// The names of the send steps when the run has some and none of them sent: a
+// step a condition skipped has no result, one that failed and went on says so.
+function unsentSendSteps(context) {
+  if (SEND_STEPS.length === 0) return null;
+  var sent = SEND_STEPS.some(function(step) {
+    var result = context[step.id];
+    return !!result && !utils.isFatalNodeResult(result);
+  });
+  return sent ? null : SEND_STEPS.map(function(step) { return step.label; });
+}
+
 async function run(event, context, resumeFrom) {
   context = context && typeof context === 'object' ? context : {};
   // Shared fire-and-forget queue — drained before the run settles.
@@ -2350,13 +2397,16 @@ async function run(event, context, resumeFrom) {
     sourceRef: WORKFLOW_ID,
     orderId: trigger.order && trigger.order.id ? String(trigger.order.id) : null,
   };
+  var outcome;
   try {
-    return await runNodes(context, resumeFrom || null);
+    outcome = await runNodes(context, resumeFrom || null);
   } catch (error) {
 ${generateErrorHandlerRunBlock('Automation error handler failed:')}
     await utils.settlePendingNodePromises(context);
     throw error;
   }
+  var unsent = outcome.waiting ? null : unsentSendSteps(context);
+  return unsent ? Object.assign({}, outcome, { sentNothing: unsent }) : outcome;
 }
 
 module.exports.run = run;

package/src/automations/dispatcher-source.ts

@@ -361,6 +361,14 @@ function runStatus(error, value) {
   return value && value.waiting === true ? 'waiting' : 'delivered';
 }
 
+// What a run leaves in its delivery's error column: its error, or, for a run
+// that finished, the send steps that did not send. Its status says nothing of
+// them: such a run is delivered, and is neither retried nor counted as failed.
+function runNote(error, value) {
+  if (error) return store.errorMessage(error);
+  return value && value.sentNothing ? JSON.stringify({ sentNothing: value.sentNothing }) : null;
+}
+
 // Whether a guarded write found its row (the claim it names still held it).
 function wrote(result) {
   return !!result && result.rowCount > 0;
@@ -368,7 +376,7 @@ function wrote(result) {
 
 function lateDeliveryWriter(delivery, testRun, resumePoint) {
   return function (error, value) {
-    var message = error ? store.errorMessage(error) : null;
+    var message = runNote(error, value);
     var status = testRun ? 'test' : runStatus(error, value);
     store.withClient(async function (client) {
       var finished = await client.query(FINISH_DELIVERY_SQL, [delivery.id, status, message, delivery.attempts]);
@@ -386,7 +394,7 @@ function lateWaitWriter(wait, resumedAt) {
     // Nothing is written once another dispatcher took the stale resume over:
     // that run records the outcome.
     store.withClient(function (client) {
-      return finishResume(client, wait, runStatus(error, value), error ? store.errorMessage(error) : null, resumedAt);
+      return finishResume(client, wait, runStatus(error, value), runNote(error, value), resumedAt);
     }).catch(function (writeError) {
       console.error('[automations] could not record a late resume: ' + store.errorMessage(writeError));
     });
@@ -624,7 +632,7 @@ async function deliverEvent(client, row, context) {
     var error = ran.error ? store.errorMessage(ran.error) : null;
     if (error) console.error('[automations] ' + entry.name + ' failed for event ' + row.id + ': ' + error);
     // A run that stopped at a Wait is not finished: its delivery waits too.
-    var finished = await client.query(FINISH_DELIVERY_SQL, [delivery.id, runStatus(ran.error, ran.value), error, delivery.attempts]);
+    var finished = await client.query(FINISH_DELIVERY_SQL, [delivery.id, runStatus(ran.error, ran.value), runNote(ran.error, ran.value), delivery.attempts]);
     if (resumePoint && !error && wrote(finished)) await client.query(SETTLE_FAILED_WAIT_SQL, [resumePoint.id]);
     if (error) outcome.failed += 1;
     else outcome.delivered += 1;
@@ -690,7 +698,7 @@ async function resumeWaits(client, context) {
       wait,
       eventRow,
       runStatus(ran.error, ran.value),
-      ran.error ? store.errorMessage(ran.error) : null,
+      runNote(ran.error, ran.value),
       resumedAt
     );
   }
@@ -834,7 +842,7 @@ async function runTest(input, options) {
     }, timeoutMs, lateDeliveryWriter(delivery, true));
     if (ran.timedOut) return totals;
     var wouldWait = ran.value && ran.value.wouldWait ? ran.value.wouldWait : null;
-    var note = ran.error ? store.errorMessage(ran.error) : wouldWait ? JSON.stringify({ wouldWait: wouldWait }) : null;
+    var note = wouldWait ? JSON.stringify({ wouldWait: wouldWait }) : runNote(ran.error, ran.value);
     await client.query(FINISH_DELIVERY_SQL, [delivery.id, 'test', note, delivery.attempts]);
     if (ran.error) totals.failed = 1;
     else totals.delivered = 1;

package/src/executor-generator.ts

@@ -1008,6 +1008,9 @@ async function executeWorkflow(workflowConfig, triggerContext, nodeHandlers, opt
   if (triggerContext && triggerContext.__dynamicRouteParam) {
     context.__dynamicRouteParam = triggerContext.__dynamicRouteParam;
   }
+  if (triggerContext && triggerContext.__tpa) {
+    context.__tpa = triggerContext.__tpa;
+  }
   if (triggerContext && triggerContext.triggerElement) {
     context.triggerElement = triggerContext.triggerElement;
   }
@@ -2151,6 +2154,7 @@ function buildContext(workflowConfig, triggerContext) {
     if (triggerContext.__stateValues) context.__stateValues = triggerContext.__stateValues;
     if (triggerContext.__routeParams) context.__routeParams = triggerContext.__routeParams;
     if (triggerContext.__dynamicRouteParam) context.__dynamicRouteParam = triggerContext.__dynamicRouteParam;
+    if (triggerContext.__tpa) context.__tpa = triggerContext.__tpa;
     if (triggerContext.triggerElement) context.triggerElement = triggerContext.triggerElement;
   }
   // See executeWorkflow: the page's language travels with the run.

package/src/public-step-guards.ts

@@ -103,12 +103,18 @@ const adviceFor = (staffRoles: string[]): string =>
 const SHORT_ADVICE =
   'Let only an admin role start it (a role your admin-panel pages admit), or move it into a scheduled, signed webhook or automation workflow, then publish again.'
 
+/** What to change on a site without accounts: no role can be required until it has them. */
+const NO_ACCOUNTS_ADVICE =
+  'Your site has no sign-in, so no role can be required yet: enable authentication and let only an admin role start it, or move it into a scheduled, signed webhook or automation workflow, then publish again.'
+
 /** One line of plain prose, for the person publishing. */
 export const describePublicStepRefusals = (
   refusals: PublicStepRefusal[],
-  staffRoles: string[] = [TableAccess.ADMIN_ROLE]
+  staffRoles: string[] = [TableAccess.ADMIN_ROLE],
+  hasAccounts = true
 ): string => {
-  const advice = adviceFor(staffRoles)
+  const advice = hasAccounts ? adviceFor(staffRoles) : NO_ACCOUNTS_ADVICE
+  const shortAdvice = hasAccounts ? SHORT_ADVICE : NO_ACCOUNTS_ADVICE
   const listed = refusals.slice(0, LISTED_STEPS).map(describe)
   const more = refusals.length - listed.length
   const subject =
@@ -121,10 +127,10 @@ export const describePublicStepRefusals = (
         )}${more > 0 ? `; and ${more} more` : ''}.`
   for (const candidate of [
     `${subject} ${advice}`,
-    `${subject} ${SHORT_ADVICE}`,
+    `${subject} ${shortAdvice}`,
     `On your site the step ${describe(refusals[0])}${
       refusals.length > 1 ? `, and ${refusals.length - 1} more` : ''
-    }. ${SHORT_ADVICE}`,
+    }. ${shortAdvice}`,
   ]) {
     if (candidate.length <= MAX_SENTENCE_LENGTH) {
       return candidate
@@ -132,7 +138,7 @@ export const describePublicStepRefusals = (
   }
   return `On your site ${
     refusals.length === 1 ? 'a step' : `${refusals.length} steps`
-  } meant only for an admin or your own server (a push notification or a stored-file step) can be started by others. ${SHORT_ADVICE}`
+  } meant only for an admin or your own server (a push notification or a stored-file step) can be started by others. ${shortAdvice}`
 }
 
 /**
@@ -147,11 +153,11 @@ export class PublicStepRefusalError extends Error {
   readonly code = PUBLIC_STEP_REFUSAL_CODE
   readonly refusals: PublicStepRefusal[]
 
-  constructor(refusals: PublicStepRefusal[], staffRoles?: string[]) {
+  constructor(refusals: PublicStepRefusal[], staffRoles?: string[], hasAccounts?: boolean) {
     super(
       `Publishing refused: ${JSON.stringify({
         code: PUBLIC_STEP_REFUSAL_CODE,
-        message: describePublicStepRefusals(refusals, staffRoles),
+        message: describePublicStepRefusals(refusals, staffRoles, hasAccounts),
         steps: refusals.map((r) => ({ owner: r.ownerId, node: r.nodeId, type: r.nodeType })),
       })}`
     )
@@ -443,6 +449,6 @@ export const assertNoPublicRestrictedSteps = (
   const staffRoles = TableAccess.resolveStaffRoles(authentication)
   const refusals = findPublicRestrictedSteps(workflows, { staffRoles })
   if (refusals.length > 0) {
-    throw new PublicStepRefusalError(refusals, staffRoles)
+    throw new PublicStepRefusalError(refusals, staffRoles, authentication?.enabled === true)
   }
 }

package/src/publish-refusals.ts

@@ -168,7 +168,7 @@ const publicStepRefusals = (
     ownerId: refusal.ownerId,
     ownerKind: refusal.ownerKind,
     nodeId: refusal.nodeId,
-    message: describePublicStepRefusals([refusal], staffRoles),
+    message: describePublicStepRefusals([refusal], staffRoles, authentication?.enabled === true),
   }))
 }