@teleporthq/teleport-plugin-next-workflows 0.45.5 → 0.45.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teleporthq/teleport-plugin-next-workflows",
-  "version": "0.45.5",
+  "version": "0.45.8",
   "description": "A plugin for workflow code generation in Next.js projects.",
   "author": "teleportHQ",
   "license": "MIT",
@@ -69,5 +69,5 @@
     "@teleporthq/teleport-shared": "^0.45.0",
     "@teleporthq/teleport-types": "^0.45.0"
   },
-  "gitHead": "3af9d41f936652db5b37d0a40ebcc78bdfd685a5"
+  "gitHead": "c80bb3e31711590476bd0f8f6c6962948aae20eb"
 }

package/src/account-delete-route-generator.ts

@@ -335,19 +335,28 @@ function readRequestPassword(req) {
   return String(body.password);
 }
 
-// The sign-in check (utils/auth/hash-password.js verifyPassword): bcrypt over
-// the SHA-256 of the password and AUTH_PEPPER. An account without a stored
-// password (a social sign-in) matches no password.
+// The sign-in check (utils/auth/hash-password.js checkPassword): bcrypt over
+// the SHA-256 of the password and a pepper, the project's own
+// (AUTH_PEPPER_SECRET) first, then the one every earlier hash used
+// (AUTH_PEPPER). An account without a stored password (a social sign-in)
+// matches no password.
 function passwordMatches(password, storedHash) {
   if (!storedHash || password.length > 1000) { return false; }
   var bcrypt = require('bcryptjs');
   var crypto = require('crypto');
-  var prepared = crypto.createHash('sha256').update(password + (process.env.AUTH_PEPPER || '')).digest('base64');
-  try {
-    return bcrypt.compareSync(prepared, String(storedHash));
-  } catch (e) {
-    return false;
+  var secret = process.env.AUTH_PEPPER_SECRET;
+  var peppers = typeof secret === 'string' && secret && secret.indexOf('teleporthq.secrets.') !== 0
+    ? [secret, process.env.AUTH_PEPPER || '']
+    : [process.env.AUTH_PEPPER || ''];
+  for (var i = 0; i < peppers.length; i++) {
+    var prepared = crypto.createHash('sha256').update(password + peppers[i]).digest('base64');
+    try {
+      if (bcrypt.compareSync(prepared, String(storedHash))) { return true; }
+    } catch (e) {
+      return false;
+    }
   }
+  return false;
 }
 
 ${generateFillTemplateFn()}

package/src/nodes/analytics/analytics-track-outcome.ts

@@ -20,6 +20,13 @@ import { NodeHandlerGenerator } from '../types'
  * the visitor id is the tracker's alone: a browser may still hold a persistent
  * id from before its consent was withdrawn.
  *
+ * The service takes exactly the money outcomes from a server, each with the
+ * order or booking id it dedupes a retried report on, and every other outcome
+ * from a browser only. So on the server any other name is refused as
+ * `browser-only` (an automation, a webhook or a cron has no visitor's page to
+ * report it from), and a money outcome without an id as `no-outcome-id`: an id
+ * made up here would count a retried report twice. Both say why in the logs.
+ *
  * Never throws: an outcome that cannot be reported answers `{ sent: false }`
  * and the workflow continues — analytics must never cost a sale.
  */
@@ -57,6 +64,10 @@ const SERVER_BODY = `async function analytics_track_outcome(config, context) {
   if (!name) {
     return { sent: false, reason: 'no-name' };
   }
+  if (${JSON.stringify(SERVER_ONLY_OUTCOMES)}.indexOf(name) === -1) {
+    console.warn('[analytics] the "' + name + '" outcome was not reported: only a visitor\\'s browser can report it, never a server step');
+    return { sent: false, reason: 'browser-only' };
+  }
   // \`globalThis.process\` (member access): webpack rewrites a bare \`process\`.
   var env = globalThis.process && globalThis.process.env;
   var baseUrl = (env && env.NEXT_PUBLIC_TELEPORT_ANALYTICS_URL) || '';
@@ -67,6 +78,7 @@ const SERVER_BODY = `async function analytics_track_outcome(config, context) {
   }
   // The service dedupes on this id and drops an outcome without one.
   if (config.outcomeId == null || config.outcomeId === '') {
+    console.warn('[analytics] the "' + name + '" outcome was not reported: it has no order or booking id');
     return { sent: false, reason: 'no-outcome-id' };
   }
   var ids = context && context.__tpa && typeof context.__tpa === 'object' ? context.__tpa : {};

package/src/public-step-guards.ts

@@ -103,12 +103,18 @@ const adviceFor = (staffRoles: string[]): string =>
 const SHORT_ADVICE =
   'Let only an admin role start it (a role your admin-panel pages admit), or move it into a scheduled, signed webhook or automation workflow, then publish again.'
 
+/** What to change on a site without accounts: no role can be required until it has them. */
+const NO_ACCOUNTS_ADVICE =
+  'Your site has no sign-in, so no role can be required yet: enable authentication and let only an admin role start it, or move it into a scheduled, signed webhook or automation workflow, then publish again.'
+
 /** One line of plain prose, for the person publishing. */
 export const describePublicStepRefusals = (
   refusals: PublicStepRefusal[],
-  staffRoles: string[] = [TableAccess.ADMIN_ROLE]
+  staffRoles: string[] = [TableAccess.ADMIN_ROLE],
+  hasAccounts = true
 ): string => {
-  const advice = adviceFor(staffRoles)
+  const advice = hasAccounts ? adviceFor(staffRoles) : NO_ACCOUNTS_ADVICE
+  const shortAdvice = hasAccounts ? SHORT_ADVICE : NO_ACCOUNTS_ADVICE
   const listed = refusals.slice(0, LISTED_STEPS).map(describe)
   const more = refusals.length - listed.length
   const subject =
@@ -121,10 +127,10 @@ export const describePublicStepRefusals = (
         )}${more > 0 ? `; and ${more} more` : ''}.`
   for (const candidate of [
     `${subject} ${advice}`,
-    `${subject} ${SHORT_ADVICE}`,
+    `${subject} ${shortAdvice}`,
     `On your site the step ${describe(refusals[0])}${
       refusals.length > 1 ? `, and ${refusals.length - 1} more` : ''
-    }. ${SHORT_ADVICE}`,
+    }. ${shortAdvice}`,
   ]) {
     if (candidate.length <= MAX_SENTENCE_LENGTH) {
       return candidate
@@ -132,7 +138,7 @@ export const describePublicStepRefusals = (
   }
   return `On your site ${
     refusals.length === 1 ? 'a step' : `${refusals.length} steps`
-  } meant only for an admin or your own server (a push notification or a stored-file step) can be started by others. ${SHORT_ADVICE}`
+  } meant only for an admin or your own server (a push notification or a stored-file step) can be started by others. ${shortAdvice}`
 }
 
 /**
@@ -147,11 +153,11 @@ export class PublicStepRefusalError extends Error {
   readonly code = PUBLIC_STEP_REFUSAL_CODE
   readonly refusals: PublicStepRefusal[]
 
-  constructor(refusals: PublicStepRefusal[], staffRoles?: string[]) {
+  constructor(refusals: PublicStepRefusal[], staffRoles?: string[], hasAccounts?: boolean) {
     super(
       `Publishing refused: ${JSON.stringify({
         code: PUBLIC_STEP_REFUSAL_CODE,
-        message: describePublicStepRefusals(refusals, staffRoles),
+        message: describePublicStepRefusals(refusals, staffRoles, hasAccounts),
         steps: refusals.map((r) => ({ owner: r.ownerId, node: r.nodeId, type: r.nodeType })),
       })}`
     )
@@ -443,6 +449,6 @@ export const assertNoPublicRestrictedSteps = (
   const staffRoles = TableAccess.resolveStaffRoles(authentication)
   const refusals = findPublicRestrictedSteps(workflows, { staffRoles })
   if (refusals.length > 0) {
-    throw new PublicStepRefusalError(refusals, staffRoles)
+    throw new PublicStepRefusalError(refusals, staffRoles, authentication?.enabled === true)
   }
 }

package/src/publish-refusals.ts

@@ -168,7 +168,7 @@ const publicStepRefusals = (
     ownerId: refusal.ownerId,
     ownerKind: refusal.ownerKind,
     nodeId: refusal.nodeId,
-    message: describePublicStepRefusals([refusal], staffRoles),
+    message: describePublicStepRefusals([refusal], staffRoles, authentication?.enabled === true),
   }))
 }