@appsemble/node-utils 0.24.12 → 0.25.0

package/README.md

@@ -1,9 +1,9 @@
-# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.24.12/config/assets/logo.svg) Appsemble Node Utilities
+# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.25.0/config/assets/logo.svg) Appsemble Node Utilities
 
 > NodeJS utilities used by Appsemble internally.
 
 [![npm](https://img.shields.io/npm/v/@appsemble/node-utils)](https://www.npmjs.com/package/@appsemble/node-utils)
-[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.24.12/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.24.12)
+[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.25.0/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.25.0)
 [![Prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://prettier.io)
 
 ## Table of Contents
@@ -26,5 +26,5 @@ compatibility is not guaranteed.
 
 ## License
 
-[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.24.12/LICENSE.md) ©
+[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.25.0/LICENSE.md) ©
 [Appsemble](https://appsemble.com)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsemble/node-utils",
-  "version": "0.24.12",
+  "version": "0.25.0",
   "description": "NodeJS utilities used by Appsemble internally.",
   "keywords": [
     "app",
@@ -38,8 +38,8 @@
     "test": "vitest"
   },
   "dependencies": {
-    "@appsemble/types": "0.24.12",
-    "@appsemble/utils": "0.24.12",
+    "@appsemble/types": "0.25.0",
+    "@appsemble/utils": "0.25.0",
     "@formatjs/fast-memoize": "^2.0.0",
     "@fortawesome/fontawesome-free": "^6.0.0",
     "@koa/cors": "^4.0.0",

package/server/controllers/action.js

@@ -73,6 +73,10 @@ async function handleRequestProxy(ctx, app, action, useBody, options) {
         email_verified: Boolean((_b = (_a = user.EmailAuthorizations) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.verified),
         zoneinfo: user.timezone,
     }, options, ctx);
+    const proxyUrl = new URL(String(remap(action.url, data, remapperContext)));
+    if (/\/api\/apps\/\d+\/action\/.*/.test(proxyUrl.pathname) && ctx.URL.host === proxyUrl.host) {
+        throwKoaError(ctx, 400, 'Not allowed to make direct requests to the Appsemble action controller using this action.');
+    }
     let params;
     try {
         if (query.params) {
@@ -84,7 +88,7 @@ async function handleRequestProxy(ctx, app, action, useBody, options) {
     }
     let axiosConfig = {
         method: (_c = action.method) !== null && _c !== void 0 ? _c : 'GET',
-        url: String(remap(action.url, data, remapperContext)),
+        url: String(proxyUrl),
         params,
         responseType: 'arraybuffer',
         headers: {},

package/server/controllers/resources.js

@@ -1,3 +1,5 @@
+import { randomUUID } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
 import { assertKoaError, getRemapperContext, getResourceDefinition, logger, processResourceBody, throwKoaError, } from '@appsemble/node-utils';
 import { defaultLocale, remap } from '@appsemble/utils';
 function generateQuery(ctx, { parseQuery }) {
@@ -178,23 +180,37 @@ export function createCreateResource(options) {
         // If the app has already been seeded, only new ephemeral resources are created,
         // processed from the request body.
         if (app.demoMode) {
-            if (!resourceSeeded) {
+            if (!resourceSeeded && app.seed) {
+                const preparedSeedAssets = structuredClone(preparedAssets);
+                const preparedSeedResources = resources.map((resource) => {
+                    var _a;
+                    const cleanResource = { ...resource };
+                    for (const referencedProperty of Object.keys((_a = resourceDefinition.references) !== null && _a !== void 0 ? _a : {})) {
+                        delete cleanResource[referencedProperty];
+                    }
+                    return {
+                        ...cleanResource,
+                        $seed: true,
+                        $ephemeral: false,
+                    };
+                });
+                for (const preparedSeedAsset of preparedSeedAssets) {
+                    const index = resources.findIndex(({ $clonable: clonable, $ephemeral: ephemeral, $seed: seed, ...cleanResource }) => {
+                        const { $clonable, $ephemeral, $seed, ...cleanAssetResource } = preparedSeedAsset.resource;
+                        return isDeepStrictEqual(cleanResource, cleanAssetResource);
+                    });
+                    const previousAssetId = preparedSeedAsset.id;
+                    const newAssetId = randomUUID();
+                    const updatedResource = JSON.parse(JSON.stringify(preparedSeedResources[index]).replace(previousAssetId, newAssetId));
+                    preparedSeedAsset.id = newAssetId;
+                    preparedSeedAsset.resource = updatedResource;
+                    preparedSeedResources[index] = updatedResource;
+                }
                 await createAppResourcesWithAssets({
                     app,
                     context: ctx,
-                    resources: resources.map((resource) => {
-                        var _a;
-                        const cleanResource = { ...resource };
-                        for (const referencedProperty of Object.keys((_a = resourceDefinition.references) !== null && _a !== void 0 ? _a : {})) {
-                            delete cleanResource[referencedProperty];
-                        }
-                        return {
-                            ...cleanResource,
-                            $seed: true,
-                            $ephemeral: false,
-                        };
-                    }),
-                    preparedAssets,
+                    resources: preparedSeedResources,
+                    preparedAssets: preparedSeedAssets,
                     resourceType,
                     action,
                     options,