@exulu/backend 1.27.1 → 1.27.2

package/CHANGELOG.md

@@ -1,7 +1,6 @@
-## [1.27.1](https://github.com/Qventu/exulu-backend/compare/v1.27.0...v1.27.1) (2025-10-15)
+## [1.27.2](https://github.com/Qventu/exulu-backend/compare/v1.27.1...v1.27.2) (2025-10-16)
 
 
 ### Bug Fixes
 
-* add readme how to update older releases ([637acac](https://github.com/Qventu/exulu-backend/commit/637acac7a05d3d0ed6b54e2c2e033fef59be9274))
-* generat key ([2d931e8](https://github.com/Qventu/exulu-backend/commit/2d931e8774f0c86674dd960a46a54768abd41a46))
+* update password encryption ([ef28351](https://github.com/Qventu/exulu-backend/commit/ef283513dead8fbce50f06157e51ef5c19e10641))

package/dist/index.cjs

@@ -2063,6 +2063,11 @@ function createMutations(table, agents, contexts, tools, config) {
       delete input.RBAC;
       delete input.created_by;
       input = encryptSensitiveFields(input);
+      if (table.name.singular === "user" && input.password) {
+        console.log("[EXULU] Hashing password", input.password);
+        input.password = await import_bcryptjs3.default.hash(input.password, SALT_ROUNDS);
+        console.log("[EXULU] Hashed password", input.password);
+      }
       Object.keys(input).forEach((key) => {
         if (table.fields.find((field) => field.name === key)?.type === "json") {
           if (typeof input[key] === "object" || Array.isArray(input[key])) {
@@ -2092,7 +2097,7 @@ function createMutations(table, agents, contexts, tools, config) {
         }).select("*");
         await handleRBACUpdate(db3, table.name.singular, result.id, rbacData, existingRbacRecords);
       }
-      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id });
+      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id, config });
       return {
         item: finalizeRequestedFields({ table, requestedFields, agents, contexts, tools, result, user: context.user.id }),
         job
@@ -2107,6 +2112,11 @@ function createMutations(table, agents, contexts, tools, config) {
       delete input.RBAC;
       delete input.created_by;
       input = encryptSensitiveFields(input);
+      if (table.name.singular === "user" && input.password) {
+        console.log("[EXULU] Hashing password", input.password);
+        input.password = await import_bcryptjs3.default.hash(input.password, SALT_ROUNDS);
+        console.log("[EXULU] Hashed password", input.password);
+      }
       Object.keys(input).forEach((key) => {
         if (table.fields.find((field) => field.name === key)?.type === "json") {
           if (typeof input[key] === "object" || Array.isArray(input[key])) {
@@ -2128,7 +2138,7 @@ function createMutations(table, agents, contexts, tools, config) {
       const requestedFields = getRequestedFields(info);
       const columns = await db3(tableNamePlural).columnInfo();
       const result = await db3.from(tableNamePlural).select(Object.keys(columns)).where({ id }).first();
-      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id });
+      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id, config });
       return {
         item: finalizeRequestedFields({ table, requestedFields, agents, contexts, tools, result, user: context.user.id }),
         job
@@ -2322,16 +2332,19 @@ var applyAccessControl = (table, user, query) => {
     query = query.where("created_by", user.id);
     return query;
   }
-  const hasRBAC = table.RBAC === true;
-  if (!hasRBAC) {
-    return query;
-  }
   if (table.name.plural !== "agent_sessions" && user.super_admin === true) {
     return query;
   }
+  console.log("[EXULU] user.role", user.role);
+  console.log("[EXULU] table.name.plural", table.name.plural);
   if (!user.super_admin && (!user.role || !(table.name.plural === "agents" && (user.role.agents === "read" || user.role.agents === "write")) && !(table.name.plural === "workflow_templates" && (user.role.workflows === "read" || user.role.workflows === "write")) && !(table.name.plural === "variables" && (user.role.variables === "read" || user.role.variables === "write")) && !(table.name.plural === "users" && (user.role.users === "read" || user.role.users === "write")) && !((table.name.plural === "test_cases" || table.name.plural === "eval_sets" || table.name.plural === "eval_runs") && (user.role.evals === "read" || user.role.evals === "write")))) {
     console.error("==== Access control error: no role found or no access to entity type. ====");
-    return query.where("1", "=", "0");
+    return query.where("id", "=", "0");
+  }
+  const hasRBAC = table.RBAC === true;
+  console.log("[EXULU] hasRBAC", hasRBAC);
+  if (!hasRBAC) {
+    return query;
   }
   try {
     query = query.where(function() {

package/dist/index.js

@@ -2012,6 +2012,11 @@ function createMutations(table, agents, contexts, tools, config) {
       delete input.RBAC;
       delete input.created_by;
       input = encryptSensitiveFields(input);
+      if (table.name.singular === "user" && input.password) {
+        console.log("[EXULU] Hashing password", input.password);
+        input.password = await bcrypt3.hash(input.password, SALT_ROUNDS);
+        console.log("[EXULU] Hashed password", input.password);
+      }
       Object.keys(input).forEach((key) => {
         if (table.fields.find((field) => field.name === key)?.type === "json") {
           if (typeof input[key] === "object" || Array.isArray(input[key])) {
@@ -2041,7 +2046,7 @@ function createMutations(table, agents, contexts, tools, config) {
         }).select("*");
         await handleRBACUpdate(db3, table.name.singular, result.id, rbacData, existingRbacRecords);
       }
-      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id });
+      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id, config });
       return {
         item: finalizeRequestedFields({ table, requestedFields, agents, contexts, tools, result, user: context.user.id }),
         job
@@ -2056,6 +2061,11 @@ function createMutations(table, agents, contexts, tools, config) {
       delete input.RBAC;
       delete input.created_by;
       input = encryptSensitiveFields(input);
+      if (table.name.singular === "user" && input.password) {
+        console.log("[EXULU] Hashing password", input.password);
+        input.password = await bcrypt3.hash(input.password, SALT_ROUNDS);
+        console.log("[EXULU] Hashed password", input.password);
+      }
       Object.keys(input).forEach((key) => {
         if (table.fields.find((field) => field.name === key)?.type === "json") {
           if (typeof input[key] === "object" || Array.isArray(input[key])) {
@@ -2077,7 +2087,7 @@ function createMutations(table, agents, contexts, tools, config) {
       const requestedFields = getRequestedFields(info);
       const columns = await db3(tableNamePlural).columnInfo();
       const result = await db3.from(tableNamePlural).select(Object.keys(columns)).where({ id }).first();
-      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id });
+      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id, config });
       return {
         item: finalizeRequestedFields({ table, requestedFields, agents, contexts, tools, result, user: context.user.id }),
         job
@@ -2271,16 +2281,19 @@ var applyAccessControl = (table, user, query) => {
     query = query.where("created_by", user.id);
     return query;
   }
-  const hasRBAC = table.RBAC === true;
-  if (!hasRBAC) {
-    return query;
-  }
   if (table.name.plural !== "agent_sessions" && user.super_admin === true) {
     return query;
   }
+  console.log("[EXULU] user.role", user.role);
+  console.log("[EXULU] table.name.plural", table.name.plural);
   if (!user.super_admin && (!user.role || !(table.name.plural === "agents" && (user.role.agents === "read" || user.role.agents === "write")) && !(table.name.plural === "workflow_templates" && (user.role.workflows === "read" || user.role.workflows === "write")) && !(table.name.plural === "variables" && (user.role.variables === "read" || user.role.variables === "write")) && !(table.name.plural === "users" && (user.role.users === "read" || user.role.users === "write")) && !((table.name.plural === "test_cases" || table.name.plural === "eval_sets" || table.name.plural === "eval_runs") && (user.role.evals === "read" || user.role.evals === "write")))) {
     console.error("==== Access control error: no role found or no access to entity type. ====");
-    return query.where("1", "=", "0");
+    return query.where("id", "=", "0");
+  }
+  const hasRBAC = table.RBAC === true;
+  console.log("[EXULU] hasRBAC", hasRBAC);
+  if (!hasRBAC) {
+    return query;
   }
   try {
     query = query.where(function() {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@exulu/backend",
   "author": "Qventu Bv.",
-  "version": "1.27.1",
+  "version": "1.27.2",
   "main": "./dist/index.js",
   "private": false,
   "publishConfig": {