@azteam/express 1.2.188 → 1.2.191

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@azteam/express",
-    "version": "1.2.188",
+    "version": "1.2.191",
     "main": "src/index.js",
     "engines": {
         "node": ">= 12.0.0",

package/src/AdminController.js

@@ -196,9 +196,9 @@ class AdminController extends Controller {
 
     postImportSpreadsheet() {
         return {
-            disabled: !this.roles.CREATE,
+            disabled: !this.roles.IMPORT,
             path: '/import_spreadsheet',
-            method: [adminRoleMiddleware([this.roles.CREATE]), verifyGoogleAppMiddleware(), this.methodPostImportSpreadsheet],
+            method: [adminRoleMiddleware([this.roles.IMPORT]), verifyGoogleAppMiddleware(), this.methodPostImportSpreadsheet],
         };
     }
 
@@ -208,9 +208,9 @@ class AdminController extends Controller {
 
     postExportSpreadsheet() {
         return {
-            disabled: !this.roles.READ,
+            disabled: !this.roles.EXPORT,
             path: '/export_spreadsheet',
-            method: [adminRoleMiddleware([this.roles.READ]), verifyGoogleAppMiddleware(), this.methodPostExportSpreadsheet],
+            method: [adminRoleMiddleware([this.roles.EXPORT]), verifyGoogleAppMiddleware(), this.methodPostExportSpreadsheet],
         };
     }
 }

package/src/Server.js

@@ -10,7 +10,7 @@ import morgan from 'morgan';
 import cors from 'cors';
 import _ from 'lodash';
 import 'express-async-errors';
-import {errorCatch, ErrorException, NOT_FOUND, UNKNOWN, CORS} from '@azteam/error';
+import {CORS, errorCatch, ErrorException, NOT_FOUND, UNKNOWN} from '@azteam/error';
 
 const RES_TYPE = {
     ARRAY: 'ARRAY',
@@ -18,27 +18,33 @@ const RES_TYPE = {
     DOCS: 'DOCS',
 };
 
-function omitItem(item, guard, allows) {
-    if (_.isArray(guard)) {
-        guard = _.difference(guard, allows);
+function omitItem(item, guard, allow) {
+    let guardFields = guard;
+    let itemFields = item;
+
+    if (_.isArray(guardFields)) {
+        guardFields = _.difference(guardFields, allow);
     }
 
-    if (item.toJSON) {
-        item = item.toJSON();
+    if (itemFields.toJSON) {
+        itemFields = item.toJSON();
     }
-    if (_.isObject(item)) {
-        if (guard === '*') {
-            return _.pick(item, allows);
+    if (_.isObject(itemFields)) {
+        if (guardFields === '*') {
+            return _.pick(itemFields, allow);
         }
-        return _.omit(item, guard);
+        return _.omit(itemFields, guardFields);
     }
-    return item;
+    return itemFields;
 }
 
 class Server {
     constructor(currentDir = '', options = {}) {
         this.redis = null;
-        this.options = options;
+        this.options = {
+            isAllowEmptyOrigin: true,
+            ...options,
+        };
 
         this.cookieOptions = {
             domain: null,
@@ -121,6 +127,7 @@ class Server {
         if (!_.isEmpty(this.controllers)) {
             const WHITE_LIST = this.whiteList;
             const COOKIE_OPTIONS = this.cookieOptions;
+            const {isAllowEmptyOrigin} = this.options;
 
             const app = express();
             app.use(
@@ -141,7 +148,13 @@ class Server {
                 cors({
                     credentials: true,
                     origin(origin, callback) {
-                        if (!origin || !WHITE_LIST.length || WHITE_LIST.some((re) => origin.endsWith(re))) {
+                        if (!origin) {
+                            if (isAllowEmptyOrigin) {
+                                callback(null, true);
+                            } else {
+                                callback(new ErrorException(CORS, `${origin} Not allowed by CORS`));
+                            }
+                        } else if (!WHITE_LIST.length || WHITE_LIST.some((re) => origin.endsWith(re))) {
                             callback(null, true);
                         } else {
                             callback(new ErrorException(CORS, `${origin} Not allowed by CORS`));
@@ -171,7 +184,7 @@ class Server {
                 throw new ErrorException(code, errors);
             };
 
-            app.response.success = function (data = {}, guard = [], allows = []) {
+            app.response.success = function (data = {}, guard = [], allow = []) {
                 let guardData = data;
                 if (data) {
                     let resType = null;
@@ -184,22 +197,24 @@ class Server {
                         }
                     }
 
+                    let responseGuard = guard;
+                    const responseAllows = allow;
                     if (_.isArray(guard)) {
-                        guard = [...guard, '__v', '_id', 'deleted_at', 'updated_at', 'created_id', 'modified_id'];
+                        responseGuard = [...guard, '__v', '_id', 'deleted_at', 'updated_at', 'created_id', 'modified_id'];
                         if (resType === RES_TYPE.ARRAY || resType === RES_TYPE.DOCS) {
-                            guard = [...guard, 'metadata_disable', 'metadata_keywords', 'metadata_description', 'metadata_image_url'];
+                            responseGuard = [...guard, 'metadata_disable', 'metadata_keywords', 'metadata_description', 'metadata_image_url'];
                         }
                     }
                     if (resType === RES_TYPE.DOCS) {
                         guardData.docs = _.map(data.docs, (item) => {
-                            return omitItem(item, guard, allows);
+                            return omitItem(item, responseGuard, responseAllows);
                         });
                     } else if (resType === RES_TYPE.ARRAY) {
                         guardData = _.map(data, (item) => {
-                            return omitItem(item, guard, allows);
+                            return omitItem(item, responseGuard, responseAllows);
                         });
                     } else if (resType === RES_TYPE.OBJECT) {
-                        guardData = omitItem(data, guard, allows);
+                        guardData = omitItem(data, responseGuard, responseAllows);
                     }
                 }
 
@@ -300,7 +315,7 @@ class Server {
                 }
 
                 if (this.callbackError) {
-                    this.callbackError(error);
+                    this.callbackError(error, req.originalUrl);
                 }
 
                 return res.status(error.status).json({success: false, errors: error.errors});