@teleporthq/teleport-plugin-next-workflows 0.45.6 → 0.45.9

package/dist/esm/newsletter/helper-code.js

@@ -439,8 +439,8 @@ function canSendNewsletterEmail() {
 
 // A link to one of the site's pages carries the token in its fragment: a
 // fragment never reaches a server, a CDN log or a Referer (the page's first
-// head script keeps it). The site's own unsubscribe route reads it on the
-// server, so a link to it carries it in the query.
+// head script keeps it). The site's own confirm and unsubscribe routes read it
+// on the server, so a link to one of them carries it in the query.
 function pageLink(path, token) {
   return path + (path.indexOf('/api/') === 0 ? '?t=' : '#t=') + encodeURIComponent(token);
 }

package/dist/esm/newsletter/routes-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes-code.d.ts","sourceRoot":"","sources":["../../../src/newsletter/routes-code.ts"],"names":[],"mappings":"AA0BA,6DAA6D;AAC7D,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAoB/C,eAAO,MAAM,gCAAgC,QAAO,MAuCnD,CAAA;AAED,eAAO,MAAM,8BAA8B,QAAO,MAqBjD,CAAA;AAED,eAAO,MAAM,kCAAkC,QAAO,MA0ErD,CAAA"}
+{"version":3,"file":"routes-code.d.ts","sourceRoot":"","sources":["../../../src/newsletter/routes-code.ts"],"names":[],"mappings":"AA4BA,6DAA6D;AAC7D,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAoB/C,eAAO,MAAM,gCAAgC,QAAO,MAuCnD,CAAA;AA8BD,eAAO,MAAM,8BAA8B,QAAO,MAmDjD,CAAA;AAED,eAAO,MAAM,kCAAkC,QAAO,MAkDrD,CAAA"}

package/dist/esm/newsletter/routes-code.js

@@ -8,13 +8,14 @@
  *   `footer`, `popup`, `form`), else `block`; errors are logged by code and
  *   message only (never a database row); every answer is `{ ok: true, pending }`, after at least
  *   `NEWSLETTER_MIN_RESPONSE_MS`, whatever happened to the address.
- * - `confirm` — POST `{ token }` → `{ ok, email? }`.
- * - `unsubscribe` — POST `{ token }` → `{ ok, email? }`; a GET with `?t=`
- *   (a click in a mail client) answers a small page whose button POSTs it, so a
- *   link scanner that opens every link unsubscribes nobody.
+ * - `confirm` and `unsubscribe` — POST `{ token }` → `{ ok, email? }`; a GET
+ *   with `?t=` (a click in a mail client) answers a small page whose button
+ *   POSTs it, so a link scanner that opens every link confirms and
+ *   unsubscribes nobody.
  */
 import { securityRuntimeSpecifier } from '../security-runtime/security-runtime-code';
-import { NEWSLETTER_UNSUBSCRIBE_URL, NEWSLETTER_VISITOR_LIMIT, NEWSLETTER_VISITOR_SCOPE, newsletterHelperSpecifier, } from './newsletter-scope';
+import { newsletterTokenSpec } from './helper-code';
+import { NEWSLETTER_CONFIRM_URL, NEWSLETTER_UNSUBSCRIBE_URL, NEWSLETTER_VISITOR_LIMIT, NEWSLETTER_VISITOR_SCOPE, newsletterHelperSpecifier, } from './newsletter-scope';
 /** From `pages/api/newsletter/` to the project root. */
 const RELATIVE_PREFIX = '../../..';
 /** Confirm and unsubscribe attempts per visitor per hour. */
@@ -75,31 +76,7 @@ ${methodGuard(['POST'])}
   return res.status(200).json(answer);
 };
 `;
-export const generateNewsletterConfirmRoute = () => `${ROUTE_PREAMBLE}
-
-module.exports = async function handler(req, res) {
-${methodGuard(['POST'])}
-  if (!(await __security.rateLimitRequest(req, res, { scope: 'newsletter-confirm', limit: ${NEWSLETTER_LINK_VISITOR_LIMIT}, windowSeconds: 3600 }))) {
-    return;
-  }
-  var body = readBody(req);
-  var token = typeof body.token === 'string' ? body.token : '';
-  if (!token) {
-    return res.status(200).json({ ok: false });
-  }
-  try {
-    var result = await __newsletter.withNewsletterDb(function (db) {
-      return __newsletter.confirmNewsletter({ db: db, token: token, req: req });
-    });
-    return res.status(200).json(result.ok ? { ok: true, email: result.email } : { ok: false });
-  } catch (err) {
-    return __security.sendClientError(res, 503, 'We could not confirm the subscription. Please try again in a moment.', __newsletter.safeError(err));
-  }
-};
-`;
-export const generateNewsletterUnsubscribeRoute = () => `${ROUTE_PREAMBLE}
-
-function escapeHtml(value) {
+const LINK_PAGE_CODE = `function escapeHtml(value) {
   return String(value == null ? '' : value)
     .replace(/&/g, '&')
     .replace(/</g, '&lt;')
@@ -123,7 +100,63 @@ function sendPage(res, status, title, message, form) {
     'button{font:inherit;padding:10px 18px;border:0;border-radius:6px;background:#111;color:#fff;cursor:pointer}</style>' +
     '</head><body><h1>' + escapeHtml(title) + '</h1><p>' + escapeHtml(message) + '</p>' + (form || '') + '</body></html>'
   );
-}
+}`;
+const CONFIRM_LINK_DAYS = newsletterTokenSpec.confirmMaxAgeSeconds / 86400;
+export const generateNewsletterConfirmRoute = () => `${ROUTE_PREAMBLE}
+
+${LINK_PAGE_CODE}
+
+var NOT_A_LINK = 'This confirmation link does not work. A link works for ${CONFIRM_LINK_DAYS} days: sign up again to get a new one.';
+
+module.exports = async function handler(req, res) {
+${methodGuard(['GET', 'POST'])}
+  if (!(await __security.rateLimitRequest(req, res, { scope: 'newsletter-confirm', limit: ${NEWSLETTER_LINK_VISITOR_LIMIT}, windowSeconds: 3600 }))) {
+    return;
+  }
+  if (req.method === 'GET') {
+    // Opening the link changes nothing (a mail client's link scanner opens it
+    // too, and double opt-in means the person's own action): the button does.
+    var linkToken = req.query && typeof req.query.t === 'string' ? req.query.t : '';
+    if (!__newsletter.verifyNewsletterToken(linkToken, 'confirm')) {
+      return sendPage(res, 200, 'Link not valid', NOT_A_LINK, '');
+    }
+    return sendPage(
+      res,
+      200,
+      'Confirm your subscription',
+      'Receive the newsletter at this address?',
+      '<form method="post" action="${NEWSLETTER_CONFIRM_URL}"><input type="hidden" name="t" value="' +
+        escapeHtml(linkToken) + '"><button type="submit">Confirm subscription</button></form>'
+    );
+  }
+  var body = readBody(req);
+  var fromForm = String((req.headers && req.headers['content-type']) || '').indexOf('application/x-www-form-urlencoded') !== -1;
+  var token = typeof body.token === 'string' ? body.token : typeof body.t === 'string' ? body.t : '';
+  var result = { ok: false };
+  try {
+    if (token) {
+      result = await __newsletter.withNewsletterDb(function (db) {
+        return __newsletter.confirmNewsletter({ db: db, token: token, req: req });
+      });
+    }
+  } catch (err) {
+    if (fromForm) {
+      console.error('[newsletter] confirm failed:', __newsletter.safeError(err));
+      return sendPage(res, 503, 'Please try again', 'We could not confirm your subscription just now. Please try again in a moment.', '');
+    }
+    return __security.sendClientError(res, 503, 'We could not confirm the subscription. Please try again in a moment.', __newsletter.safeError(err));
+  }
+  if (fromForm) {
+    return result.ok
+      ? sendPage(res, 200, "You're subscribed", 'Thank you for confirming. You will receive the newsletter at this address.', '')
+      : sendPage(res, 200, 'Link not valid', NOT_A_LINK, '');
+  }
+  return res.status(200).json(result.ok ? { ok: true, email: result.email } : { ok: false });
+};
+`;
+export const generateNewsletterUnsubscribeRoute = () => `${ROUTE_PREAMBLE}
+
+${LINK_PAGE_CODE}
 
 var NOT_A_LINK = 'This unsubscribe link does not work. Use the link in a newer email from us.';
 

package/dist/esm/newsletter/routes-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes-code.js","sourceRoot":"","sources":["../../../src/newsletter/routes-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAA;AACpF,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAA;AAE3B,wDAAwD;AACxD,MAAM,eAAe,GAAG,UAAU,CAAA;AAElC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAA;AAE/C,MAAM,cAAc,GAAG,6BAA6B,wBAAwB,CAAC,eAAe,CAAC;8BAC/D,yBAAyB,CAAC,eAAe,CAAC;;;;;;;;EAQtE,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,OAAiB,EAAU,EAAE,CAAC,SAAS,OAAO;KAChE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,MAAM,GAAG,CAAC;KAC7C,IAAI,CAAC,MAAM,CAAC;8BACe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;IAE5C,CAAA;AAEJ,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAW,EAAE,CAAC,GAAG,cAAc;;;EAG7E,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;OAChB,wBAAwB;mDACoB,wBAAwB;8EACG,wBAAwB,aAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiC1I,CAAA;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAW,EAAE,CAAC,GAAG,cAAc;;;EAG3E,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;4FACqE,6BAA6B;;;;;;;;;;;;;;;;;CAiBxH,CAAA;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAW,EAAE,CAAC,GAAG,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+B/E,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gGACkE,6BAA6B;;;;;;;;;;;;;;qCAcxF,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4B9D,CAAA"}
+{"version":3,"file":"routes-code.js","sourceRoot":"","sources":["../../../src/newsletter/routes-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAA;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAA;AAE3B,wDAAwD;AACxD,MAAM,eAAe,GAAG,UAAU,CAAA;AAElC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAA;AAE/C,MAAM,cAAc,GAAG,6BAA6B,wBAAwB,CAAC,eAAe,CAAC;8BAC/D,yBAAyB,CAAC,eAAe,CAAC;;;;;;;;EAQtE,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,OAAiB,EAAU,EAAE,CAAC,SAAS,OAAO;KAChE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,MAAM,GAAG,CAAC;KAC7C,IAAI,CAAC,MAAM,CAAC;8BACe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;IAE5C,CAAA;AAEJ,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAW,EAAE,CAAC,GAAG,cAAc;;;EAG7E,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;OAChB,wBAAwB;mDACoB,wBAAwB;8EACG,wBAAwB,aAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiC1I,CAAA;AAED,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;EAwBrB,CAAA;AAEF,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,GAAG,KAAK,CAAA;AAE1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAW,EAAE,CAAC,GAAG,cAAc;;EAE3E,cAAc;;2EAE2D,iBAAiB;;;EAG1F,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;4FAC8D,6BAA6B;;;;;;;;;;;;;;;qCAepF,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4B1D,CAAA;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAW,EAAE,CAAC,GAAG,cAAc;;EAE/E,cAAc;;;;;EAKd,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gGACkE,6BAA6B;;;;;;;;;;;;;;qCAcxF,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4B9D,CAAA"}

package/dist/esm/nodes/analytics/analytics-track-outcome.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics-track-outcome.d.ts","sourceRoot":"","sources":["../../../../src/nodes/analytics/analytics-track-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAkH/C,eAAO,MAAM,qBAAqB,EAAE,oBASnC,CAAA"}
+{"version":3,"file":"analytics-track-outcome.d.ts","sourceRoot":"","sources":["../../../../src/nodes/analytics/analytics-track-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AA8H/C,eAAO,MAAM,qBAAqB,EAAE,oBASnC,CAAA"}

package/dist/esm/nodes/analytics/analytics-track-outcome.js

@@ -18,6 +18,13 @@
  * the visitor id is the tracker's alone: a browser may still hold a persistent
  * id from before its consent was withdrawn.
  *
+ * The service takes exactly the money outcomes from a server, each with the
+ * order or booking id it dedupes a retried report on, and every other outcome
+ * from a browser only. So on the server any other name is refused as
+ * `browser-only` (an automation, a webhook or a cron has no visitor's page to
+ * report it from), and a money outcome without an id as `no-outcome-id`: an id
+ * made up here would count a retried report twice. Both say why in the logs.
+ *
  * Never throws: an outcome that cannot be reported answers `{ sent: false }`
  * and the workflow continues — analytics must never cost a sale.
  */
@@ -53,6 +60,10 @@ const SERVER_BODY = `async function analytics_track_outcome(config, context) {
   if (!name) {
     return { sent: false, reason: 'no-name' };
   }
+  if (${JSON.stringify(SERVER_ONLY_OUTCOMES)}.indexOf(name) === -1) {
+    console.warn('[analytics] the "' + name + '" outcome was not reported: only a visitor\\'s browser can report it, never a server step');
+    return { sent: false, reason: 'browser-only' };
+  }
   // \`globalThis.process\` (member access): webpack rewrites a bare \`process\`.
   var env = globalThis.process && globalThis.process.env;
   var baseUrl = (env && env.NEXT_PUBLIC_TELEPORT_ANALYTICS_URL) || '';
@@ -63,6 +74,7 @@ const SERVER_BODY = `async function analytics_track_outcome(config, context) {
   }
   // The service dedupes on this id and drops an outcome without one.
   if (config.outcomeId == null || config.outcomeId === '') {
+    console.warn('[analytics] the "' + name + '" outcome was not reported: it has no order or booking id');
     return { sent: false, reason: 'no-outcome-id' };
   }
   var ids = context && context.__tpa && typeof context.__tpa === 'object' ? context.__tpa : {};

package/dist/esm/nodes/analytics/analytics-track-outcome.js.map

@@ -1 +1 @@
-{"version":3,"file":"analytics-track-outcome.js","sourceRoot":"","sources":["../../../../src/nodes/analytics/analytics-track-outcome.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,oBAAoB,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;AAEzD,MAAM,WAAW,GAAG;;;;;QAKZ,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;EAoB1C,CAAA;AAEF,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0DlB,CAAA;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAyB;IACzD,QAAQ,EAAE,yBAAyB;IACnC,YAAY,EAAE,WAAW;IACzB,eAAe;QACb,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,qBAAqB;QACnB,OAAO,WAAW,CAAA;IACpB,CAAC;CACF,CAAA"}
+{"version":3,"file":"analytics-track-outcome.js","sourceRoot":"","sources":["../../../../src/nodes/analytics/analytics-track-outcome.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,oBAAoB,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;AAEzD,MAAM,WAAW,GAAG;;;;;QAKZ,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;EAoB1C,CAAA;AAEF,MAAM,WAAW,GAAG;;;;;QAKZ,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0D1C,CAAA;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAyB;IACzD,QAAQ,EAAE,yBAAyB;IACnC,YAAY,EAAE,WAAW;IACzB,eAAe;QACb,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,qBAAqB;QACnB,OAAO,WAAW,CAAA;IACpB,CAAC;CACF,CAAA"}