stack-auth · N2D4 · Sep 3, 2025 · Aug 31, 2025 · Aug 31, 2025 · Sep 2, 2025
diff --git a/apps/backend/prisma/migrations/20250903080405_workflows/migration.sql b/apps/backend/prisma/migrations/20250903080405_workflows/migration.sql
@@ -0,0 +1,81 @@
+-- CreateTable
+CREATE TABLE "WorkflowTriggerToken" (
+    "tenancyId" UUID NOT NULL,
+    "id" UUID NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "WorkflowTriggerToken_pkey" PRIMARY KEY ("tenancyId","id")
+);
+
+-- CreateTable
+CREATE TABLE "WorkflowTrigger" (
+    "tenancyId" UUID NOT NULL,
+    "id" UUID NOT NULL,
+    "executionId" UUID NOT NULL,
+    "triggerData" JSONB NOT NULL,
+    "scheduledAt" TIMESTAMP(3),
+    "output" JSONB,
+    "error" JSONB,
+    "compiledWorkflowId" UUID,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "WorkflowTrigger_pkey" PRIMARY KEY ("tenancyId","id")
+);
+
+-- CreateTable
+CREATE TABLE "WorkflowExecution" (
+    "tenancyId" UUID NOT NULL,
+    "id" UUID NOT NULL,
+    "workflowId" TEXT NOT NULL,
+    "triggerIds" TEXT[],
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "WorkflowExecution_pkey" PRIMARY KEY ("tenancyId","id")
+);
+
+-- CreateTable
+CREATE TABLE "CurrentlyCompilingWorkflow" (
+    "tenancyId" UUID NOT NULL,
+    "workflowId" TEXT NOT NULL,
+    "compilationVersion" INTEGER NOT NULL,
+    "sourceHash" TEXT NOT NULL,
+    "startedCompilingAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "CurrentlyCompilingWorkflow_pkey" PRIMARY KEY ("tenancyId","workflowId","compilationVersion","sourceHash")
+);
+
+-- CreateTable
+CREATE TABLE "CompiledWorkflow" (
+    "tenancyId" UUID NOT NULL,
+    "id" UUID NOT NULL,
+    "workflowId" TEXT NOT NULL,
+    "compilationVersion" INTEGER NOT NULL,
+    "sourceHash" TEXT NOT NULL,
+    "compiledCode" TEXT,
+    "compileError" TEXT,
+    "compiledAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "registeredTriggers" TEXT[],
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "CompiledWorkflow_pkey" PRIMARY KEY ("tenancyId","id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "WorkflowTriggerToken_tenancyId_tokenHash_key" ON "WorkflowTriggerToken"("tenancyId", "tokenHash");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "CompiledWorkflow_tenancyId_workflowId_compilationVersion_so_key" ON "CompiledWorkflow"("tenancyId", "workflowId", "compilationVersion", "sourceHash");
+
+-- AddForeignKey
+ALTER TABLE "WorkflowTrigger" ADD CONSTRAINT "WorkflowTrigger_tenancyId_compiledWorkflowId_fkey" FOREIGN KEY ("tenancyId", "compiledWorkflowId") REFERENCES "CompiledWorkflow"("tenancyId", "id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "WorkflowTrigger" ADD CONSTRAINT "WorkflowTrigger_tenancyId_executionId_fkey" FOREIGN KEY ("tenancyId", "executionId") REFERENCES "WorkflowExecution"("tenancyId", "id") ON DELETE RESTRICT ON UPDATE CASCADE;
diff --git a/apps/backend/prisma/schema.prisma b/apps/backend/prisma/schema.prisma
@@ -24,7 +24,7 @@ model Project {
   fullLogoUrl      String?
 
   projectConfigOverride Json?
-  stripeAccountId             String?
+  stripeAccountId       String?
 
   apiKeySets                 ApiKeySet[]
   projectUsers               ProjectUser[]
@@ -773,15 +773,109 @@ model ItemQuantityChange {
 }
 
 model DataVaultEntry {
-  id         String   @default(uuid()) @db.Uuid
-  tenancyId  String   @db.Uuid
-  storeId    String
-  hashedKey  String
-  encrypted  Json     // Contains { edkBase64, ciphertextBase64 } from encryptWithKms()
-  createdAt  DateTime @default(now())
-  updatedAt  DateTime @updatedAt
+  id        String   @default(uuid()) @db.Uuid
+  tenancyId String   @db.Uuid
+  storeId   String
+  hashedKey String
+  encrypted Json // Contains { edkBase64, ciphertextBase64 } from encryptWithKms()
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
 
   @@id([tenancyId, id])
   @@unique([tenancyId, storeId, hashedKey])
   @@index([tenancyId, storeId])
 }
+
+model WorkflowTriggerToken {
+  tenancyId String @db.Uuid
+  id        String @default(uuid()) @db.Uuid
+
+  tokenHash String
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  expiresAt DateTime
+
+  @@id([tenancyId, id])
+  @@unique([tenancyId, tokenHash])
+}
+
+model WorkflowTrigger {
+  tenancyId   String @db.Uuid
+  id          String @default(uuid()) @db.Uuid
+  executionId String @db.Uuid
+
+  triggerData Json
+
+  // the following fields determine the state of the trigger:
+  // - scheduledAt && !compiledWorkflowId && !output && !error: the trigger is scheduled to be executed
+  // - !scheduledAt && compiledWorkflowId && !output && !error: the trigger is currently executing
+  // - !scheduledAt && compiledWorkflowId && output && !error: the trigger has successfully completed execution
+  // - !scheduledAt && compiledWorkflowId && !output && error: the trigger has failed execution
+  // All other combinations are invalid.
+  scheduledAt        DateTime?
+  output             Json?
+  error              Json?
+  compiledWorkflowId String?           @db.Uuid
+  compiledWorkflow   CompiledWorkflow? @relation(fields: [tenancyId, compiledWorkflowId], references: [tenancyId, id])
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  execution WorkflowExecution @relation(fields: [tenancyId, executionId], references: [tenancyId, id])
+
+  @@id([tenancyId, id])
+}
+
+model WorkflowExecution {
+  tenancyId String @db.Uuid
+  id        String @default(uuid()) @db.Uuid
+
+  workflowId String
+
+  triggerIds String[]
+  triggers   WorkflowTrigger[]
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@id([tenancyId, id])
+}
+
+model CurrentlyCompilingWorkflow {
+  tenancyId          String @db.Uuid
+  workflowId         String
+  compilationVersion Int
+  sourceHash         String
+
+  startedCompilingAt DateTime @default(now())
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@id([tenancyId, workflowId, compilationVersion, sourceHash])
+}
+
+model CompiledWorkflow {
+  tenancyId          String @db.Uuid
+  id                 String @default(uuid()) @db.Uuid
+  workflowId         String // note: The workflow with this ID may have been edited or deleted in the meantime, so there may be multiple CompiledWorkflows with the same workflowId
+  compilationVersion Int
+  sourceHash         String
+
+  // exactly one of [compiledCode, compileError] must be set
+  compiledCode String?
+  compileError String?
+
+  compiledAt         DateTime @default(now())
+  registeredTriggers String[]
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  workflowTriggers WorkflowTrigger[]
+
+  @@id([tenancyId, id])
+  @@unique([tenancyId, workflowId, compilationVersion, sourceHash])
+}
diff --git a/apps/backend/src/app/api/latest/users/crud.tsx b/apps/backend/src/app/api/latest/users/crud.tsx
@@ -5,6 +5,7 @@ import { ensureTeamMembershipExists, ensureUserExists } from "@/lib/request-chec
 import { Tenancy, getSoleTenancyFromProjectBranch, getTenancy } from "@/lib/tenancies";
 import { PrismaTransaction } from "@/lib/types";
 import { sendTeamMembershipDeletedWebhook, sendUserCreatedWebhook, sendUserDeletedWebhook, sendUserUpdatedWebhook } from "@/lib/webhooks";
+import { triggerWorkflows } from "@/lib/workflows";
 import { RawQuery, getPrismaClientForSourceOfTruth, getPrismaClientForTenancy, getPrismaSchemaForSourceOfTruth, getPrismaSchemaForTenancy, globalPrismaClient, rawQuery, retryTransaction, sqlQuoteIdent } from "@/prisma-client";
 import { createCrudHandlers } from "@/route-handlers/crud-handler";
 import { uploadAndGetUrl } from "@/s3";
@@ -648,6 +649,14 @@ export const usersCrudHandlers = createLazyProxy(() => createCrudHandlers(usersC
 
     await createPersonalTeamIfEnabled(prisma, auth.tenancy, result);
 
+    // if the user is not an anonymous user, trigger onSignUp workflows
+    if (!result.is_anonymous) {
+      await triggerWorkflows(auth.tenancy, {
+        type: "sign-up",
+        userId: result.id,
+      });
+    }
+
     runAsynchronouslyAndWaitUntil(sendUserCreatedWebhook({
       projectId: auth.project.id,
       data: result,
@@ -948,8 +957,15 @@ export const usersCrudHandlers = createLazyProxy(() => createCrudHandlers(usersC
         }
       }
 
-      // if we went from anonymous to non-anonymous, rename the personal team
+      // if we went from anonymous to non-anonymous:
       if (oldUser.isAnonymous && data.is_anonymous === false) {
+        // trigger onSignUp workflows
+        await triggerWorkflows(auth.tenancy, {
+          type: "sign-up",
+          userId: params.user_id,
+        });
+
+        // rename the personal team
         await tx.team.updateMany({
           where: {
             tenancyId: auth.tenancy.id,

diff --git a/apps/backend/src/lib/email-rendering.tsx b/apps/backend/src/lib/email-rendering.tsx
@@ -1,6 +1,5 @@
 import { Freestyle } from '@/lib/freestyle';
 import { emptyEmailTheme } from '@stackframe/stack-shared/dist/helpers/emails';
-import { getEnvVariable, getNodeEnvironment } from '@stackframe/stack-shared/dist/utils/env';
 import { StackAssertionError } from '@stackframe/stack-shared/dist/utils/errors';
 import { bundleJavaScript } from '@stackframe/stack-shared/dist/utils/esbuild';
 import { get, has } from '@stackframe/stack-shared/dist/utils/objects';
@@ -53,7 +52,6 @@ export async function renderEmailWithTemplate(
     previewMode?: boolean,
   },
 ): Promise<Result<{ html: string, text: string, subject?: string, notificationCategory?: string }, string>> {
-  const apiKey = getEnvVariable("STACK_FREESTYLE_API_KEY");
   const variables = options.variables ?? {};
   const previewMode = options.previewMode ?? false;
   const user = (previewMode && !options.user) ? { displayName: "John Doe" } : options.user;
@@ -114,17 +112,17 @@ export async function renderEmailWithTemplate(
     return Result.error(result.error);
   }
 
-  const freestyle = new Freestyle({ apiKey });
+  const freestyle = new Freestyle();
   const nodeModules = {
     "react": "19.1.1",
     "@react-email/components": "0.1.1",
     "arktype": "2.1.20",
   };
   const output = await freestyle.executeScript(result.data, { nodeModules });
-  if ("error" in output) {
-    return Result.error(output.error as string);
+  if (output.status === "error") {
+    return Result.error(`${output.error}`);
   }
-  return Result.ok(output.result as { html: string, text: string, subject: string, notificationCategory: string });
+  return Result.ok(output.data.result as { html: string, text: string, subject: string, notificationCategory: string });
 }
 
 

diff --git a/apps/backend/src/lib/freestyle.tsx b/apps/backend/src/lib/freestyle.tsx
@@ -1,18 +1,24 @@
 import { traceSpan } from '@/utils/telemetry';
-import { getNodeEnvironment } from '@stackframe/stack-shared/dist/utils/env';
-import { StackAssertionError, captureError, errorToNiceString } from '@stackframe/stack-shared/dist/utils/errors';
+import { getEnvVariable, getNodeEnvironment } from '@stackframe/stack-shared/dist/utils/env';
+import { StackAssertionError } from '@stackframe/stack-shared/dist/utils/errors';
+import { parseJson } from '@stackframe/stack-shared/dist/utils/json';
+import { Result } from '@stackframe/stack-shared/dist/utils/results';
 import { FreestyleSandboxes } from 'freestyle-sandboxes';
 
 export class Freestyle {
   private freestyle: FreestyleSandboxes;
 
-  constructor(options: { apiKey: string }) {
+  constructor(options: { apiKey?: string } = {}) {
+    const apiKey = options.apiKey || getEnvVariable("STACK_FREESTYLE_API_KEY");
     let baseUrl = undefined;
-    if (["development", "test"].includes(getNodeEnvironment()) && options.apiKey === "mock_stack_freestyle_key") {
+    if (apiKey === "mock_stack_freestyle_key") {
+      if (!["development", "test"].includes(getNodeEnvironment())) {
+        throw new StackAssertionError("Mock Freestyle key used in production; please set the STACK_FREESTYLE_API_KEY environment variable.");
+      }
       baseUrl = "http://localhost:8122";
     }
     this.freestyle = new FreestyleSandboxes({
-      apiKey: options.apiKey,
+      apiKey,
       baseUrl,
     });
   }
@@ -27,10 +33,15 @@ export class Freestyle {
       }
     }, async () => {
       try {
-        return await this.freestyle.executeScript(script, options);
-      } catch (error) {
-        captureError("freestyle.executeScript", error);
-        throw new StackAssertionError("Error executing script with Freestyle! " + errorToNiceString(error), { cause: error });
+        const res = await this.freestyle.executeScript(script, options);
+        return Result.ok(res);
+      } catch (e: unknown) {
+        // for whatever reason, Freestyle's errors are sometimes returned in JSON.parse(e.error.error).error (lol)
+        const wrap1 = e && typeof e === "object" && "error" in e ? e.error : e;
+        const wrap2 = wrap1 && typeof wrap1 === "object" && "error" in wrap1 ? wrap1.error : wrap1;
+        const wrap3 = wrap2 && typeof wrap2 === "string" ? Result.or(parseJson(wrap2), wrap2) : wrap2;
+        const wrap4 = wrap3 && typeof wrap3 === "object" && "error" in wrap3 ? wrap3.error : wrap3;
+        return Result.error(`${wrap4}`);
       }
     });
   }