@appsemble/node-utils 0.20.44 → 0.21.0

package/resource.js

@@ -0,0 +1,172 @@
+import { randomUUID } from 'node:crypto';
+import { handleValidatorResult } from '@appsemble/node-utils';
+import { notFound } from '@hapi/boom';
+import { addMilliseconds, isPast, parseISO } from 'date-fns';
+import { ValidationError, Validator } from 'jsonschema';
+import parseDuration from 'parse-duration';
+import { preProcessCSV } from './csv.js';
+function stripResource({ $author, $created, $editor, $updated, ...data }) {
+    return data;
+}
+/**
+ * Get the resource definition of an app by name.
+ *
+ * If there is no match, a 404 HTTP error is thrown.
+ *
+ * @param app The app to get the resource definition of
+ * @param resourceType The name of the resource definition to get.
+ * @param view The view that’s being used.
+ * @returns The matching resource definition.
+ */
+export function getResourceDefinition(app, resourceType, view) {
+    var _a;
+    if (!app) {
+        throw notFound('App not found');
+    }
+    const definition = (_a = app.definition.resources) === null || _a === void 0 ? void 0 : _a[resourceType];
+    if (!definition) {
+        throw notFound(`App does not have resources called ${resourceType}`);
+    }
+    if (view && !definition.views[view]) {
+        throw notFound(`View ${view} does not exist for resource type ${resourceType}`);
+    }
+    return definition;
+}
+/**
+ * Extracts the IDs of resource request body.
+ *
+ * @param ctx The Koa context to extract the body from.
+ * @returns A tuple which consists of:
+ *
+ *   1. One or more resources processed from the request body.
+ *   2. A list of newly uploaded assets which should be linked to the resources.
+ *   3. preValidateProperty function used for reconstructing resources from a CSV file.
+ */
+export function extractResourceBody(ctx) {
+    let body;
+    let assets;
+    let preValidateProperty;
+    if (ctx.is('multipart/form-data')) {
+        ({ assets = [], resource: body } = ctx.request.body);
+        if (Array.isArray(body) && body.length === 1) {
+            [body] = body;
+        }
+    }
+    else {
+        if (ctx.is('text/csv')) {
+            preValidateProperty = preProcessCSV;
+        }
+        ({ body } = ctx.request);
+        assets = [];
+    }
+    return [
+        Array.isArray(body) ? body.map(stripResource) : stripResource(body),
+        assets,
+        preValidateProperty,
+    ];
+}
+/**
+ * Process an incoming resource request body.
+ *
+ * This handles JSON schema validation, resource expiration, and asset linking and validation.
+ *
+ * @param ctx The Koa context to process.
+ * @param definition The resource definition to use for processing the request body.
+ * @param knownAssetIds A list of asset IDs that are already known to be linked to the resource.
+ * @param knownExpires A previously known expires value.
+ * @returns A tuple which consists of:
+ *
+ *   1. One or more resources processed from the request body.
+ *   2. A list of newly uploaded assets which should be linked to the resources.
+ *   3. Asset IDs from the `knownAssetIds` array which are no longer used.
+ */
+export function processResourceBody(ctx, definition, knownAssetIds = [], knownExpires) {
+    const [resource, assets, preValidateProperty] = extractResourceBody(ctx);
+    const validator = new Validator();
+    const assetIdMap = new Map();
+    const assetUsedMap = new Map();
+    const reusedAssets = new Set();
+    const preparedAssets = assets.map(({ contents, filename, mime }, index) => {
+        const id = randomUUID();
+        assetIdMap.set(index, id);
+        assetUsedMap.set(index, false);
+        return { data: contents, filename, id, mime };
+    });
+    validator.customFormats.binary = (input) => {
+        if (knownAssetIds.includes(input)) {
+            reusedAssets.add(input);
+            return true;
+        }
+        if (!/^\d+$/.test(input)) {
+            return false;
+        }
+        const num = Number(input);
+        if (assetUsedMap.get(num)) {
+            return false;
+        }
+        return num >= 0 && num < assets.length;
+    };
+    const patchedSchema = {
+        ...definition.schema,
+        required: ctx.request.method === 'PATCH' ? [] : definition.schema.required,
+        properties: {
+            ...definition.schema.properties,
+            id: { type: 'integer' },
+            $expires: { type: 'string', format: 'date-time' },
+            $clonable: { type: 'boolean' },
+        },
+    };
+    const customErrors = [];
+    const expiresDuration = definition.expires ? parseDuration(definition.expires) : undefined;
+    const result = validator.validate(resource, Array.isArray(resource) ? { type: 'array', items: patchedSchema } : patchedSchema, {
+        base: '#',
+        preValidateProperty,
+        nestedErrors: true,
+        rewrite(value, { format }, options, { path }) {
+            if (Array.isArray(resource)
+                ? path.length === 2 && typeof path[0] === 'number' && path[1] === '$expires'
+                : path.length === 1 && path[0] === '$expires') {
+                if (value !== undefined) {
+                    const date = parseISO(value);
+                    if (isPast(date)) {
+                        customErrors.push(new ValidationError('has already passed', value, null, path));
+                    }
+                    return date;
+                }
+                if (knownExpires) {
+                    return knownExpires;
+                }
+                if (expiresDuration) {
+                    return addMilliseconds(new Date(), expiresDuration);
+                }
+            }
+            if (value === undefined) {
+                return;
+            }
+            if (format !== 'binary') {
+                return value;
+            }
+            if (knownAssetIds.includes(value)) {
+                return value;
+            }
+            const num = Number(value);
+            if (!assetIdMap.has(num)) {
+                return value;
+            }
+            const uuid = assetIdMap.get(num);
+            const currentResource = Array.isArray(resource) ? resource[path[0]] : resource;
+            preparedAssets.find((asset) => asset.id === uuid).resource = currentResource;
+            assetUsedMap.set(num, true);
+            return uuid;
+        },
+    });
+    result.errors.push(...customErrors);
+    for (const [assetId, used] of assetUsedMap.entries()) {
+        if (!used) {
+            result.errors.push(new ValidationError('is not referenced from the resource', assetId, null, ['assets', assetId], 'binary', 'format'));
+        }
+    }
+    handleValidatorResult(result, 'Resource validation failed');
+    return [resource, preparedAssets, knownAssetIds.filter((id) => !reusedAssets.has(id))];
+}
+//# sourceMappingURL=resource.js.map

package/scim.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The SCIM protocol uses the HTTP response status codes defined in
+ * [Section 6 of [RFC7231]](https://datatracker.ietf.org/doc/html/rfc7231#section-6) to indicate
+ * operation success or failure. In addition to returning an HTTP response code, implementers
+ * **MUST** return the errors in the body of the response in a JSON format, using the attributes
+ * described below. Error responses are identified using the following "schema" URI:
+ * `"urn:ietf:params:scim:api:messages:2.0:Error"`.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7644#section-3.12
+ */
+export declare class SCIMError extends Error {
+    schemas: string[];
+    /**
+     * The HTTP status code (see
+     * [Section 6 of [RFC7231]](https://datatracker.ietf.org/doc/html/rfc7231#section-6)) expressed as
+     * a JSON string.
+     */
+    status: string;
+    /**
+     * A detailed human-readable message.
+     */
+    detail: string;
+    constructor(status: number, detail: string);
+    toJSON(): Pick<SCIMError, 'detail' | 'schemas' | 'status'>;
+}
+export declare function scimAssert(condition: unknown, status: number, detail: string): asserts condition;

package/scim.js

@@ -0,0 +1,32 @@
+/**
+ * The SCIM protocol uses the HTTP response status codes defined in
+ * [Section 6 of [RFC7231]](https://datatracker.ietf.org/doc/html/rfc7231#section-6) to indicate
+ * operation success or failure. In addition to returning an HTTP response code, implementers
+ * **MUST** return the errors in the body of the response in a JSON format, using the attributes
+ * described below. Error responses are identified using the following "schema" URI:
+ * `"urn:ietf:params:scim:api:messages:2.0:Error"`.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7644#section-3.12
+ */
+export class SCIMError extends Error {
+    constructor(status, detail) {
+        super(detail);
+        this.schemas = ['urn:ietf:params:scim:api:messages:2.0:Error'];
+        this.detail = detail;
+        this.name = 'SCIMError';
+        this.status = String(status);
+    }
+    toJSON() {
+        return {
+            detail: this.detail,
+            schemas: this.schemas,
+            status: this.status,
+        };
+    }
+}
+export function scimAssert(condition, status, detail) {
+    if (!condition) {
+        throw new SCIMError(status, detail);
+    }
+}
+//# sourceMappingURL=scim.js.map

package/server/controllers/action.d.ts

@@ -0,0 +1,7 @@
+import { type Options } from '@appsemble/node-utils';
+import { type Middleware } from 'koa';
+export declare function createProxyDelete(options: Options): Middleware;
+export declare function createProxyGet(options: Options): Middleware;
+export declare function createProxyPatch(options: Options): Middleware;
+export declare function createProxyPost(options: Options): Middleware;
+export declare function createProxyPut(options: Options): Middleware;

package/server/controllers/action.js

@@ -0,0 +1,129 @@
+import { getRemapperContext, logger } from '@appsemble/node-utils';
+import { defaultLocale, formatRequestAction, remap } from '@appsemble/utils';
+import { badGateway, badRequest, methodNotAllowed, notFound } from '@hapi/boom';
+import axios from 'axios';
+import { get, pick } from 'lodash-es';
+import pkg from '../../package.json' assert { type: 'json' };
+/**
+ * These response headers are forwarded when proxying requests.
+ */
+const allowResponseHeaders = [
+    'content-encoding',
+    'content-length',
+    'content-type',
+    'transfer-encoding',
+];
+const supportedActions = ['email', 'notify', 'request'];
+async function handleEmail(ctx, app, action, options) {
+    const { mailer, method, request: { body: data }, user, } = ctx;
+    if (method !== 'POST') {
+        throw methodNotAllowed('Method must be POST for email actions');
+    }
+    const { email, reloadUser } = options;
+    await reloadUser({ context: ctx });
+    await email({ action, data, mailer, user, options, context: ctx });
+    ctx.status = 204;
+}
+async function handleNotify(ctx, app, action, options) {
+    var _a, _b;
+    const { request: { body: data }, user, } = ctx;
+    const { reloadUser, sendNotifications } = options;
+    await reloadUser({ context: ctx });
+    const remapperContext = await getRemapperContext(app, app.definition.defaultLanguage || defaultLocale, user && {
+        sub: user.id,
+        name: user.name,
+        email: user.primaryEmail,
+        email_verified: Boolean((_b = (_a = user.EmailAuthorizations) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.verified),
+        zoneinfo: user.timezone,
+    }, options, ctx);
+    const to = remap(action.to, data, remapperContext);
+    const title = remap(action.title, data, remapperContext);
+    const body = remap(action.body, data, remapperContext);
+    await sendNotifications({ app, to, title, body });
+    ctx.status = 204;
+}
+async function handleRequestProxy(ctx, app, action, useBody, options) {
+    var _a, _b;
+    const { method, query, request: { body }, user, } = ctx;
+    let data;
+    if (useBody) {
+        data = body;
+    }
+    else {
+        try {
+            data = JSON.parse(query.data);
+        }
+        catch {
+            throw badRequest('data should be a JSON object');
+        }
+    }
+    const { applyAppServiceSecrets, reloadUser } = options;
+    await reloadUser({ context: ctx });
+    const remapperContext = await getRemapperContext(app, app.definition.defaultLanguage || defaultLocale, user && {
+        sub: user.id,
+        name: user.name,
+        email: user.primaryEmail,
+        email_verified: Boolean((_b = (_a = user.EmailAuthorizations) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.verified),
+        zoneinfo: user.timezone,
+    }, options, ctx);
+    let axiosConfig = formatRequestAction(action, data, (remapper, d) => remap(remapper, d, remapperContext), remapperContext.context);
+    axiosConfig = await applyAppServiceSecrets({ axiosConfig, context: ctx, app });
+    if (axiosConfig.method.toUpperCase() !== method) {
+        throw badRequest('Method does match the request action method');
+    }
+    if (useBody) {
+        axiosConfig.data = data;
+    }
+    axiosConfig.headers['user-agent'] = `AppsembleServer/${pkg.version}`;
+    axiosConfig.responseType = 'stream';
+    axiosConfig.validateStatus = () => true;
+    let response;
+    logger.verbose(`Forwarding request to ${axios.getUri(axiosConfig)}`);
+    try {
+        response = await axios(axiosConfig);
+    }
+    catch (err) {
+        logger.error(err);
+        throw badGateway();
+    }
+    ctx.status = response.status;
+    ctx.set(pick(response.headers, allowResponseHeaders));
+    ctx.body = response.data;
+}
+function createProxyHandler(useBody, options) {
+    return async (ctx) => {
+        const { pathParams: { appId, path }, } = ctx;
+        const app = await options.getApp({ context: ctx, query: { where: { id: appId } } });
+        if (!app) {
+            throw notFound('App not found');
+        }
+        const appAction = get(app.definition, path);
+        const action = supportedActions.find((act) => act === (appAction === null || appAction === void 0 ? void 0 : appAction.type));
+        switch (action) {
+            case 'email':
+                return handleEmail(ctx, app, appAction, options);
+            case 'notify':
+                return handleNotify(ctx, app, appAction, options);
+            case 'request':
+                return handleRequestProxy(ctx, app, appAction, useBody, options);
+            default:
+                throw badRequest('path does not point to a proxyable action');
+        }
+    };
+}
+export function createProxyDelete(options) {
+    return createProxyHandler(false, options);
+}
+export function createProxyGet(options) {
+    return createProxyHandler(false, options);
+}
+export function createProxyPatch(options) {
+    return createProxyHandler(true, options);
+}
+export function createProxyPost(options) {
+    return createProxyHandler(true, options);
+}
+export function createProxyPut(options) {
+    return createProxyHandler(true, options);
+}
+//# sourceMappingURL=action.js.map

package/server/controllers/appMembers.d.ts

@@ -0,0 +1,3 @@
+import { type Middleware } from 'koa';
+import { type Options } from '../types.js';
+export declare function createGetAppMember({ getApp, getAppMembers }: Options): Middleware;

package/server/controllers/appMembers.js

@@ -0,0 +1,19 @@
+import { notFound } from '@hapi/boom';
+export function createGetAppMember({ getApp, getAppMembers }) {
+    return async (ctx) => {
+        const { pathParams: { appId, memberId }, } = ctx;
+        const app = await getApp({ context: ctx, query: { where: { id: appId } } });
+        if (!app) {
+            throw notFound('App not found');
+        }
+        if (app.definition.security === undefined) {
+            throw notFound('App does not have a security definition');
+        }
+        const appMembers = await getAppMembers({ context: ctx, app, memberId });
+        if (appMembers.length !== 1) {
+            throw notFound('App member not found');
+        }
+        ctx.body = appMembers[0];
+    };
+}
+//# sourceMappingURL=appMembers.js.map

package/server/controllers/appMessages.d.ts

@@ -0,0 +1,3 @@
+import { type Options } from '@appsemble/node-utils';
+import { type Middleware } from 'koa';
+export declare function createGetMessages({ getApp, getAppMessages, getBlockMessages, }: Options): Middleware;

package/server/controllers/appMessages.js

@@ -0,0 +1,75 @@
+import { getAppsembleMessages, mergeMessages, } from '@appsemble/node-utils';
+import { defaultLocale, extractAppMessages, normalizeBlockName, } from '@appsemble/utils';
+import { badRequest, notFound } from '@hapi/boom';
+import tags from 'language-tags';
+export function createGetMessages({ getApp, getAppMessages, getBlockMessages, }) {
+    return async (ctx) => {
+        var _a, _b, _c, _d, _e;
+        const { pathParams: { appId, language }, query: { merge, override = 'true' }, } = ctx;
+        if (!tags.check(language)) {
+            throw badRequest(`Language “${language}” is invalid`);
+        }
+        const lang = language.toLowerCase();
+        const baseLanguage = tags(language)
+            .subtags()
+            .find((sub) => sub.type() === 'language');
+        const baseLang = baseLanguage && String(baseLanguage).toLowerCase();
+        const app = await getApp({ context: ctx, query: { where: { id: appId } } });
+        if (!app) {
+            throw notFound('App not found');
+        }
+        const appMessages = await getAppMessages({ context: ctx, app, language });
+        const blockPrefixes = [];
+        const blockQuery = [];
+        const coreMessages = await getAppsembleMessages(lang, baseLang);
+        const messages = {
+            core: Object.fromEntries(Object.entries(coreMessages).filter(([key]) => key.startsWith('app') || key.startsWith('react-components') || key.startsWith('server'))),
+            blocks: {},
+            ...extractAppMessages(app.definition, (block, prefix) => {
+                const blockName = normalizeBlockName(block.type);
+                const [org, name] = blockName.split('/');
+                blockQuery.push({ version: block.version, OrganizationId: org.slice(1), name });
+                blockPrefixes.push([blockName, prefix]);
+            }),
+        };
+        const blockMessages = await getBlockMessages({ context: ctx, blockQuery, baseLang, lang });
+        if ((!appMessages.length || (merge && !appMessages.some((m) => m.language === lang))) &&
+            lang !== (app.definition.defaultLanguage || defaultLocale)) {
+            throw notFound(`Language “${language}” could not be found`);
+        }
+        const baseLanguageMessages = override === 'true' && appMessages.find((m) => m.language === baseLang);
+        const languageMessages = override === 'true' && appMessages.find((m) => m.language === lang);
+        for (const block of blockMessages) {
+            const { name } = block;
+            const defaultMessages = (_a = block.messages) === null || _a === void 0 ? void 0 : _a[defaultLocale];
+            const blockBaseLanguageMessages = baseLang && ((_b = block.messages) === null || _b === void 0 ? void 0 : _b[baseLang]);
+            const blockLanguageMessages = (_c = block.messages) === null || _c === void 0 ? void 0 : _c[language];
+            const blockVersionMessages = {
+                ...defaultMessages,
+                ...Object.fromEntries(Object.entries(blockBaseLanguageMessages !== null && blockBaseLanguageMessages !== void 0 ? blockBaseLanguageMessages : {}).filter(([, value]) => value)),
+                ...Object.fromEntries(Object.entries(blockLanguageMessages !== null && blockLanguageMessages !== void 0 ? blockLanguageMessages : {}).filter(([, value]) => value)),
+            };
+            if (messages.blocks[name]) {
+                messages.blocks[name][block.version] = blockVersionMessages;
+            }
+            else {
+                messages.blocks[name] = {
+                    [block.version]: blockVersionMessages,
+                };
+            }
+            if (override !== 'true') {
+                const prefixed = blockPrefixes.filter(([b]) => b === name);
+                for (const [messageId, value] of Object.entries(blockVersionMessages)) {
+                    for (const [, prefix] of prefixed) {
+                        messages.app[`${prefix.join('.')}.${messageId}`] = value;
+                    }
+                }
+            }
+        }
+        ctx.body = {
+            language: lang,
+            messages: mergeMessages(messages, (_d = baseLanguageMessages === null || baseLanguageMessages === void 0 ? void 0 : baseLanguageMessages.messages) !== null && _d !== void 0 ? _d : {}, (_e = languageMessages === null || languageMessages === void 0 ? void 0 : languageMessages.messages) !== null && _e !== void 0 ? _e : {}),
+        };
+    };
+}
+//# sourceMappingURL=appMessages.js.map

package/server/controllers/assets.d.ts

@@ -0,0 +1,5 @@
+import { type Options } from '@appsemble/node-utils';
+import { type Middleware } from 'koa';
+export declare function createGetAssets({ checkRole, getApp, getAppAssets }: Options): Middleware;
+export declare function createGetAssetById({ getApp, getAppAssets }: Options): Middleware;
+export declare function createCreateAsset({ createAppAsset, getApp }: Options): Middleware;

package/server/controllers/assets.js

@@ -0,0 +1,74 @@
+import { Permission } from '@appsemble/utils';
+import { notFound } from '@hapi/boom';
+import { extension } from 'mime-types';
+export function createGetAssets({ checkRole, getApp, getAppAssets }) {
+    return async (ctx) => {
+        const { pathParams: { appId }, queryParams: { $skip, $top }, } = ctx;
+        const app = await getApp({ context: ctx, query: { where: { id: appId } } });
+        if (!app) {
+            throw notFound('App not found');
+        }
+        const findOptions = {
+            limit: $top,
+            offset: $skip,
+            where: { AppId: app.id },
+        };
+        await checkRole({ context: ctx, app, permissions: Permission.ReadAssets, findOptions });
+        ctx.body = await getAppAssets({ app, context: ctx });
+    };
+}
+export function createGetAssetById({ getApp, getAppAssets }) {
+    return async (ctx) => {
+        const { pathParams: { appId, assetId }, } = ctx;
+        const app = await getApp({ context: ctx, query: { where: { id: appId } } });
+        if (!app) {
+            throw notFound('App not found');
+        }
+        const assets = await getAppAssets({ app, context: ctx });
+        // Pick asset id over asset name
+        const asset = assets.find((a) => a.id === assetId) || assets.find((a) => a.name === assetId);
+        if (!asset) {
+            throw notFound('Asset not found');
+        }
+        if (assetId !== asset.id) {
+            // Redirect to asset using current asset ID
+            ctx.status = 302;
+            ctx.set('location', `/api/apps/${app.id}/assets/${asset.id}`);
+            ctx.type = null;
+            return;
+        }
+        let { filename, mime } = asset;
+        if (!filename) {
+            filename = asset.id;
+            if (mime) {
+                const ext = extension(mime);
+                if (ext) {
+                    filename += `.${ext}`;
+                }
+            }
+        }
+        ctx.set('content-type', mime || 'application/octet-stream');
+        if (filename) {
+            ctx.set('content-disposition', `attachment; filename=${JSON.stringify(filename)}`);
+        }
+        ctx.set('Cache-Control', 'max-age=31536000,immutable');
+        ctx.body = asset.data;
+    };
+}
+export function createCreateAsset({ createAppAsset, getApp }) {
+    return async (ctx) => {
+        const { pathParams: { appId }, request: { body: { file: { contents, filename, mime }, name, }, }, } = ctx;
+        const app = await getApp({ context: ctx, query: { where: { id: appId } } });
+        if (!app) {
+            throw notFound('App not found');
+        }
+        const asset = await createAppAsset({
+            app,
+            context: ctx,
+            payload: { filename, mime, name, data: contents },
+        });
+        ctx.status = 201;
+        ctx.body = { id: asset.id, mime, filename, name };
+    };
+}
+//# sourceMappingURL=assets.js.map

package/server/controllers/index.d.ts

@@ -0,0 +1,7 @@
+export * from './action.js';
+export * from './appMessages.js';
+export * from './assets.js';
+export * from './resources.js';
+export * from './appMembers.js';
+export * from './teams.js';
+export * from './oauth2Provider.js';

package/server/controllers/index.js

@@ -0,0 +1,8 @@
+export * from './action.js';
+export * from './appMessages.js';
+export * from './assets.js';
+export * from './resources.js';
+export * from './appMembers.js';
+export * from './teams.js';
+export * from './oauth2Provider.js';
+//# sourceMappingURL=index.js.map

package/server/controllers/oauth2Provider.d.ts

@@ -0,0 +1,3 @@
+import { type Middleware } from 'koa';
+import { type Options } from '../types.js';
+export declare function createGetUserInfo({ getAppUserInfo }: Options): Middleware;

package/server/controllers/oauth2Provider.js

@@ -0,0 +1,7 @@
+export function createGetUserInfo({ getAppUserInfo }) {
+    return async (ctx) => {
+        const { client, user } = ctx;
+        ctx.body = await getAppUserInfo({ context: ctx, client, user });
+    };
+}
+//# sourceMappingURL=oauth2Provider.js.map

package/server/controllers/resources.d.ts

@@ -0,0 +1,8 @@
+import { type Options } from '@appsemble/node-utils';
+import { type Middleware } from 'koa';
+export declare function createQueryResources(options: Options): Middleware;
+export declare function createCountResources(options: Options): Middleware;
+export declare function createGetResourceById(options: Options): Middleware;
+export declare function createCreateResource(options: Options): Middleware;
+export declare function createUpdateResource(options: Options): Middleware;
+export declare function createDeleteResource(options: Options): Middleware;