@galadrim/galadmin 0.1.228 → 0.1.232

package/dist/types/config.d.ts

@@ -360,6 +360,7 @@ export type AuthRole = {
     useArgon2?: boolean;
 };
 export type Config = {
+    enriched?: boolean;
     name: string;
     sessionSecret: string;
     useMysql2?: boolean;

package/dist/utils/dbManager.js

@@ -74,7 +74,7 @@ class dbManager {
                 port: config.mysql.port || 3306,
                 charset: 'UTF8MB4_GENERAL_CI',
                 dateStrings: true,
-                multipleStatements: true
+                multipleStatements: config.mysql.multipleStatements === true
             });
             this.dbType = "MYSQL";
         }

package/dist/utils/dbManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"dbManager.js","sourceRoot":"","sources":["../../src/utils/dbManager.ts"],"names":[],"mappings":";;AAAA,+BAA+B;AAC/B,iCAAiC;AACjC,yBAAyB;AAEzB,SAAS,YAAY,CAAC,UAAU,EAAE,MAAM;IACpC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAEnF,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,SAAS,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;YAE9C,OAAO,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9B,SAAS,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,SAAS,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO;QACP,QAAQ;KACX,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK;IAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEjC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAE9d,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,SAAQ;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,QAAQ,GAAG,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAEjI,CAAC;aAAM,CAAC;YACJ,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACX,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAC3B,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAA;QACjG,CAAC;IACL,CAAC;IAED,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAExD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAqB,SAAS;IAI1B,IAAI,CAAC,MAAM;QACP,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;gBACtD,eAAe,EAAE,EAAE;gBACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI;gBAC/B,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,IAAI;gBACjB,kBAAkB,EAAE,IAAI;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QAC1B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI;gBACpC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC/B,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC/C,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC3C,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBACtC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,EAAE,MAAM,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,EAAE,CAAC,CAAA;gBACzD,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AA/CD,4BA+CC"}
+{"version":3,"file":"dbManager.js","sourceRoot":"","sources":["../../src/utils/dbManager.ts"],"names":[],"mappings":";;AAAA,+BAA+B;AAC/B,iCAAiC;AACjC,yBAAyB;AAEzB,SAAS,YAAY,CAAC,UAAU,EAAE,MAAM;IACpC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAEnF,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,SAAS,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;YAE9C,OAAO,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9B,SAAS,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,SAAS,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO;QACP,QAAQ;KACX,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK;IAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEjC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAE9d,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,SAAQ;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,QAAQ,GAAG,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAEjI,CAAC;aAAM,CAAC;YACJ,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACX,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAC3B,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAA;QACjG,CAAC;IACL,CAAC;IAED,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAExD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAqB,SAAS;IAI1B,IAAI,CAAC,MAAM;QACP,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;gBACtD,eAAe,EAAE,EAAE;gBACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI;gBAC/B,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,IAAI;gBAIjB,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,IAAI;aAC/D,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QAC1B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI;gBACpC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC/B,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC/C,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC3C,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBACtC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,EAAE,MAAM,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,EAAE,CAAC,CAAA;gBACzD,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAlDD,4BAkDC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galadrim/galadmin",
-  "version": "0.1.228",
+  "version": "0.1.232",
   "main": "dist/index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",
@@ -41,7 +41,8 @@
     "@types/express": "^4.17.13",
     "@types/express-session": "1.17.0",
     "@types/mime": "^2.0.3",
-    "@types/node": "^16.18.11"
+    "@types/node": "^16.18.11",
+    "typescript": "^5.9.3"
   },
   "repository": {
     "type": "git",

package/src/api.ts

@@ -23,13 +23,150 @@ function generateUniqueIdForObject(obj) {
   return hash;
 }
 
-export default (db, config, user) => {
+declare global {
+  namespace Express {
+    interface Request {
+      config?: any;
+    }
+  }
+}
+
+export default (db, config) => {
   const app = express();
 
+  app.use((req, res, next) => {
+    req.config = {
+      ...config,
+      views: config.views
+        .filter(x => !x.roles
+          || (req.session.user && ([...(x.roles || []), ...(x.readRoles || [])].includes(req.session.user.role)))
+        )
+        .map(view => {
+          const readOnly = req.session.user && view.roles && !view.roles.includes(req.session.user.role)
+          if (readOnly) {
+            return {
+              ...view,
+              canEdit: false,
+              canCreate: false,
+              canDelete: false,
+              clickToEdit: false
+            }
+          } else {
+            return view;
+          }
+        })
+        .map(view => {
+          if (view.type === "table") {
+            return {
+              ...view,
+              columns: view.columns.filter(column => !column.roles || (req.session.user && column.roles.includes(req.session.user.role)))
+            }
+          } else {
+            return view;
+          }
+        })
+    }
+    next();
+  });
+
   app.use(async (req, res, next) => {
-    if (!config.enriched) {
-      await enrichConfig(config, db);
+    if (!req.config.enriched) {
+      await enrichConfig(req.config, db);
+    }
+    next();
+  });
+
+  // ---------------------------------------------------------------------------
+  // SECURITY: server-side authorization.
+  //
+  // The config-filtering middleware above only decides which views the *client*
+  // is shown, and sets canEdit/canCreate/canDelete flags on that served config.
+  // Nothing enforced those decisions server-side, so a session with the lowest
+  // role could POST directly to /updateRecord, /deleteRecord, /customQuery, …
+  // and act on any view — including read-only ones — as the DB user (root).
+  // This block re-checks every sensitive route against the view's declared roles.
+  // ---------------------------------------------------------------------------
+  const ROOT_ROLE = "root";
+  const roleOf = (req) => req.session && req.session.user && req.session.user.role;
+  // Write access = the view's `roles` (root always allowed).
+  const canWriteView = (view, role) =>
+    role === ROOT_ROLE || !view || !view.roles || view.roles.includes(role);
+
+  const viewFromRequest = (req) => {
+    const idx =
+      req.body && req.body.viewIndex !== undefined
+        ? req.body.viewIndex
+        : req.query && req.query.viewIndex !== undefined
+        ? req.query.viewIndex
+        : undefined;
+    if (idx === undefined || !req.config || !req.config.views) return undefined;
+    return req.config.views[idx];
+  };
+
+  // Routes that mutate data and reference their target view via viewIndex
+  // (body for POST bodies, query for /uploadFile). Import routes carry the
+  // viewIndex inside a multipart body and are guarded inline in their handlers.
+  const MUTATING_VIEW_ROUTES = new Set([
+    "/updateRecord",
+    "/createRecord",
+    "/deleteRecord",
+    "/deleteRecords",
+    "/deleteRecordFromPanel",
+    "/customAction",
+    "/uploadFile",
+  ]);
+  // /duplicateRecord references its table via req.body.table (not a viewIndex),
+  // so it is guarded inline in its handler instead of by the generic middleware.
+
+  // Column names are interpolated into INSERT/UPDATE statements; only accept plain
+  // SQL identifiers so a crafted key cannot break out of the column list.
+  const areSafeColumnNames = (data) =>
+    !data ||
+    Object.keys(data).every((k) => /^[A-Za-z0-9_]+$/.test(k));
+
+  // Tables the current role is allowed to write, gathered from its writable views
+  // and their creatable panels — used to bound /duplicateRecord's target table.
+  const writableTables = (req) => {
+    const role = roleOf(req);
+    const tables = new Set<string>();
+    for (const view of req.config?.views || []) {
+      if (!canWriteView(view, role)) continue;
+      if (view.tableName) tables.add(view.tableName);
+      for (const panel of view.recordViewPanels || []) {
+        if (panel.tableName) tables.add(panel.tableName);
+        if (panel.createConfig?.tableName) tables.add(panel.createConfig.tableName);
+      }
+    }
+    return tables;
+  };
+
+  // Reject client-supplied SQL fragments (the `filters` array is concatenated
+  // raw into the WHERE clause). With multipleStatements off this already blocks
+  // stacked writes; the pattern also blocks UNION/comment/file exfil breakouts.
+  const looksLikeSqlBreakout = (frag) =>
+    typeof frag === "string" &&
+    /(;|--|\/\*|\bunion\b|\binto\s+(out|dump)file\b|\bsleep\s*\(|\bbenchmark\s*\(|\bload_file\s*\()/i.test(
+      frag
+    );
+
+  app.use((req, res, next) => {
+    const role = roleOf(req);
+
+    // 1) Validate any raw filter fragments on read endpoints.
+    if (req.body && Array.isArray(req.body.filters)) {
+      if (req.body.filters.some(looksLikeSqlBreakout)) {
+        return res.status(400).send({ error: "Invalid filter" });
+      }
+    }
+
+    // 2) Enforce write authorization on mutating routes.
+    if (MUTATING_VIEW_ROUTES.has(req.path)) {
+      const view = viewFromRequest(req);
+      if (!view || !canWriteView(view, role)) {
+        return res.sendStatus(403);
+      }
     }
+
     next();
   });
 
@@ -124,7 +261,7 @@ export default (db, config, user) => {
 
   app.get("/config", async (req, res) => {
     try {
-      const { mysql, auth, sessionSecret, ...safeConfig } = config;
+      const { mysql, auth, sessionSecret, ...safeConfig } = req.config;
       res.send({
         config: serializeJs(safeConfig),
       });
@@ -201,7 +338,7 @@ export default (db, config, user) => {
   };
 
   app.post("/foreignSelectRecords", async (req, res, next) => {
-    const view = config.views[req.body.viewIndex];
+    const view = req.config.views[req.body.viewIndex];
     const column = [
       ...view.columns,
       ...(view.recordViewPanels
@@ -222,7 +359,7 @@ export default (db, config, user) => {
           ? `${column.searchableName} LIKE '${column.wholeSearch ? "%" : ""}${queryEscaped}%'`
           : null,
         column.filtersFromUser
-          ? column.filtersFromUser(user.userId, user.role)
+          ? column.filtersFromUser(req.session.user.userId, req.session.user.role)
           : null,
       ]),
       join: column.join,
@@ -256,7 +393,7 @@ export default (db, config, user) => {
   });
 
   app.post("/records", async function (req, res, next) {
-    const view = config.views[req.body.viewIndex];
+    const view = req.config.views[req.body.viewIndex];
     const isDesc = req.body.isDesc === null ? view.isDesc : req.body.isDesc;
     const subview =
       view.subviews && req.body.subviewIndex !== undefined
@@ -277,7 +414,7 @@ export default (db, config, user) => {
           subview?.filters,
           ...req.body.filters,
           view.filtersFromUser
-            ? view.filtersFromUser(user.userId, user.role)
+            ? view.filtersFromUser(req.session.user.userId, req.session.user.role)
             : null,
         ]),
         having: subview?.having,
@@ -352,11 +489,11 @@ export default (db, config, user) => {
           " = " +
           (typeof data[key] === "string"
             ? "'" +
-              data[key]
-                .replace(/'/g, "\\'")
-                .replace(/\n/g, "")
-                .replace(/\r/g, "") +
-              "'"
+            data[key]
+              .replace(/'/g, "\\'")
+              .replace(/\n/g, "")
+              .replace(/\r/g, "") +
+            "'"
             : typeof data[key] === "object"
               ? JSON.stringify(data[key])
               : data[key]) +
@@ -400,7 +537,7 @@ export default (db, config, user) => {
   }
 
   app.post("/recordsExport", async function (req, res) {
-    const view = config.views[req.body.viewIndex];
+    const view = req.config.views[req.body.viewIndex];
     const orderBy = req.body.orderBy || view.orderBy;
     const isDesc = req.body.isDesc === null ? view.isDesc : req.body.isDesc;
     const subview =
@@ -462,7 +599,7 @@ export default (db, config, user) => {
         return res.status(500).send(err);
       }
       // Get viewIndex in fields
-      const view = config.views[fields.viewIndex[0]];
+      const view = req.config.views[fields.viewIndex[0]];
       if (typeof view.parseImportFile !== "function") {
         return res
           .status(500)
@@ -553,7 +690,7 @@ export default (db, config, user) => {
         return res.status(500).send(err);
       }
       // Get viewIndex and panelIndex in fields
-      const view = config.views[fields.viewIndex[0]];
+      const view = req.config.views[fields.viewIndex[0]];
       const panel = view.recordViewPanels[fields.panelIndex[0]];
       if (typeof panel.parseImportFile !== "function") {
         return res
@@ -634,13 +771,13 @@ export default (db, config, user) => {
   });
 
   app.get("/record", async function (req, res) {
-    const view = config.views[req.query.viewIndex as string];
+    const view = req.config.views[req.query.viewIndex as string];
     const { err, rows } = await db.query(
       "SELECT " +
-        (view.selectExpression || "*") +
-        " FROM ?? " +
-        (view.join || "") +
-        " WHERE ?? = ?",
+      (view.selectExpression || "*") +
+      " FROM ?? " +
+      (view.join || "") +
+      " WHERE ?? = ?",
       [
         view.tableName,
         view.tableName + "." + view.primaryId,
@@ -665,7 +802,10 @@ export default (db, config, user) => {
   });
 
   app.post("/updateRecord", async function (req, res, next) {
-    const view = config.views[req.body.viewIndex];
+    const view = req.config.views[req.body.viewIndex];
+    if (!areSafeColumnNames(req.body.data)) {
+      return res.status(400).send({ error: "Invalid column name" });
+    }
     for (let key in req.body.data) {
       if (
         req.body.data[key] == "NULL" ||
@@ -703,7 +843,7 @@ export default (db, config, user) => {
           data: req.body.data,
           previousData: req.body.previousData,
         });
-      } catch (e) {}
+      } catch (e) { }
     }
     if (view.editCallbackFunction) {
       await view.editCallbackFunction({
@@ -715,20 +855,20 @@ export default (db, config, user) => {
   });
 
   app.post("/customAction", async function (req, res, next) {
-    const view = config.views[req.body.viewIndex];
+    const view = req.config.views[req.body.viewIndex];
     const action = view.customActions[req.body.actionIndex];
     for (const recordId of req.body.selectedRecordIds) {
       try {
         const { rows } = await db.query(
           "SELECT " +
-            (view.selectExpression || "*") +
-            " FROM ?? " +
-            (view.join || "") +
-            " WHERE ?? = ?",
+          (view.selectExpression || "*") +
+          " FROM ?? " +
+          (view.join || "") +
+          " WHERE ?? = ?",
           [view.tableName, view.tableName + "." + view.primaryId, recordId]
         );
         const record = rows[0];
-        const actionResult = await action.action(record, user.userId);
+        const actionResult = await action.action(record, req.session.user.userId);
         if (actionResult) {
           return res.send({
             success: true,
@@ -750,13 +890,13 @@ export default (db, config, user) => {
   });
 
   app.post("/deleteRecord", async function (req, res) {
-    const view = config.views[req.body.viewIndex];
+    const view = req.config.views[req.body.viewIndex];
     const { rows, err: err2 } = await db.query(
       "SELECT " +
-        (view.selectExpression || "*") +
-        " FROM ?? " +
-        (view.join || "") +
-        " WHERE ?? = ?",
+      (view.selectExpression || "*") +
+      " FROM ?? " +
+      (view.join || "") +
+      " WHERE ?? = ?",
       [
         view.tableName,
         view.tableName + "." + view.primaryId,
@@ -783,7 +923,7 @@ export default (db, config, user) => {
         await axios.post(view.deleteCallback, {
           id: req.body.primaryValue,
         });
-      } catch (e) {}
+      } catch (e) { }
     }
     if (view.deleteCallbackFunction) {
       await view.deleteCallbackFunction({
@@ -795,7 +935,7 @@ export default (db, config, user) => {
   });
 
   app.post("/deleteRecordFromPanel", async function (req, res) {
-    const view = config.views[req.body.viewIndex];
+    const view = req.config.views[req.body.viewIndex];
     const panel = view.recordViewPanels.find(
       (x) => x.__id__ === req.body.panelId
     );
@@ -820,7 +960,7 @@ export default (db, config, user) => {
         await axios.post(panel.deleteCallback, {
           id: req.body.primaryValue,
         });
-      } catch (e) {}
+      } catch (e) { }
     }
     if (panel.deleteCallbackFunction) {
       await panel.deleteCallbackFunction({
@@ -832,7 +972,7 @@ export default (db, config, user) => {
   });
 
   app.post("/deleteRecords", async function (req, res, next) {
-    const view = config.views[req.body.viewIndex];
+    const view = req.config.views[req.body.viewIndex];
     const { err } = await db.query(
       `DELETE FROM ?? WHERE ?? IN(${req.body.primaryValues.map((x) => "'" + x + "'").join(",")})`,
       [view.tableName, view.primaryId]
@@ -866,7 +1006,7 @@ export default (db, config, user) => {
       }
     }
 
-    for (const view of config.views) {
+    for (const view of req.config.views) {
       await checkAndGetNotificationBadge(view);
       if (view.subviews) {
         for (const subview of view.subviews) {
@@ -878,6 +1018,15 @@ export default (db, config, user) => {
   });
 
   app.post("/duplicateRecord", async function (req, res, next) {
+    // SECURITY: bound the (client-supplied) target table to tables the role may write.
+    const allowedTables = writableTables(req);
+    const requestedTables = [
+      req.body.table,
+      ...(req.body.duplicateConfig?.foreignTables || []).map((t) => t.table),
+    ];
+    if (requestedTables.some((t) => !allowedTables.has(t))) {
+      return res.sendStatus(403);
+    }
     const primaryId = req.body.duplicateConfig.primaryId;
     const { err, rows } = await db.query("SELECT * FROM ?? WHERE ?? = ?", [
       req.body.table,
@@ -923,7 +1072,7 @@ export default (db, config, user) => {
   });
 
   app.post("/createRecord", async function (req, res, next) {
-    const view = config.views[req.body.viewIndex];
+    const view = req.config.views[req.body.viewIndex];
     const panel = req.body.panelIndex
       ? view.recordViewPanels[req.body.panelIndex]
       : null;
@@ -955,6 +1104,9 @@ export default (db, config, user) => {
           delete createPayload[key];
         }
       }
+      if (!areSafeColumnNames(createPayload)) {
+        return res.status(400).send({ error: "Invalid column name" });
+      }
       const queryExpression = Object.keys(createPayload).join(", ");
       const queryPlaceholders = Object.keys(createPayload)
         .map((x) => "?")
@@ -982,7 +1134,7 @@ export default (db, config, user) => {
             id: r.insertId,
             data: req.body.data,
           });
-        } catch (e) {}
+        } catch (e) { }
       }
       if (panel ? panel.createCallbackFunction : view.createCallbackFunction) {
         await (
@@ -1004,30 +1156,69 @@ export default (db, config, user) => {
     }
   });
 
-  app.get("/customQuery", async function (req, res, next) {
-    const query = (req.query.query as string).replace(
-      /\?/g,
-      req.query.primaryValue as string
-    );
-    const { err, rows } = await db.query(query);
-    if (err) {
-      return res.status(500).send(err);
+  // Collect every SQL template declared anywhere in the (role-filtered) config:
+  // panel `query`, `autocompleteListQuery`, etc. customQuery may only run a
+  // template that already exists in the config the caller is allowed to see —
+  // so it can never be turned into an arbitrary read/write primitive.
+  function collectAllowedQueries(node, acc = new Set<string>()) {
+    if (!node || typeof node !== "object") return acc;
+    if (Array.isArray(node)) {
+      for (const item of node) collectAllowedQueries(item, acc);
+      return acc;
     }
-    if (req.query.viewIndex && req.query.panelIndex) {
-      const panel =
-        config.views[req.query.viewIndex as string].recordViewPanels[
+    for (const key of Object.keys(node)) {
+      const value = node[key];
+      if (typeof value === "string" && (key === "query" || /Query$/.test(key))) {
+        acc.add(value.trim());
+      } else if (value && typeof value === "object") {
+        collectAllowedQueries(value, acc);
+      }
+    }
+    return acc;
+  }
+
+  // Attack-surface reduction: only expose /customQuery at all when the config
+  // actually declares SQL templates (panels, autocomplete lists, …). If nothing
+  // uses it, the route is replaced by an explicit "disabled" stub so the raw-SQL
+  // sink simply does not exist for that deployment.
+  const CONFIG_USES_CUSTOM_QUERY = collectAllowedQueries(config.views).size > 0;
+
+  if (!CONFIG_USES_CUSTOM_QUERY) {
+    app.get("/customQuery", (req, res) => res.sendStatus(404));
+  } else {
+    app.get("/customQuery", async function (req, res, next) {
+      const template = typeof req.query.query === "string" ? req.query.query : "";
+      // SECURITY: only run whitelisted, read-only templates, and bind the record id
+      // as a parameter instead of substituting it into the SQL string.
+      const allowed = collectAllowedQueries(req.config.views);
+      if (!allowed.has(template.trim())) {
+        return res.status(403).send({ error: "Query not allowed" });
+      }
+      if (!/^\s*\(?\s*(select|with)\b/i.test(template) || /;/.test(template)) {
+        return res.status(400).send({ error: "Only read-only queries are allowed" });
+      }
+      const placeholderCount = (template.match(/\?/g) || []).length;
+      const params = new Array(placeholderCount).fill(req.query.primaryValue);
+      const { err, rows } = await db.query(template, params);
+      if (err) {
+        return res.status(500).send(err);
+      }
+      if (req.query.viewIndex && req.query.panelIndex) {
+        const panel =
+          req.config.views[req.query.viewIndex as string].recordViewPanels[
           req.query.panelIndex as string
-        ];
-      if (panel.formatValue) {
-        for (const row of rows) {
-          for (const key in panel.formatValue) {
-            row[key] = await panel.formatValue[key](row);
+          ];
+        if (panel.formatValue) {
+          for (const row of rows) {
+            for (const key in panel.formatValue) {
+              row[key] = await panel.formatValue[key](row);
+            }
           }
         }
       }
-    }
-    res.send(rows);
-  });
+      res.send(rows);
+    });
+  }
 
   function uploadFile(column, fileParamName, req, res) {
     if (column.s3Config || column.gcpConfig) {
@@ -1171,9 +1362,9 @@ export default (db, config, user) => {
           await sftp.fastPut(
             files[fileParamName][0].path,
             column.publicPath +
-              (column.subdirectory ? "/" + column.subdirectory : "") +
-              "/" +
-              filename
+            (column.subdirectory ? "/" + column.subdirectory : "") +
+            "/" +
+            filename
           );
           await sftp.end();
           res.send({
@@ -1211,7 +1402,7 @@ export default (db, config, user) => {
   );
 
   app.post("/uploadFile", async function (req, res, next) {
-    const view = config.views[req.query.viewIndex as string];
+    const view = req.config.views[req.query.viewIndex as string];
     const column = [
       ...view.columns,
       ...(view.recordViewPanels

package/src/index.ts

@@ -130,7 +130,11 @@ export default (config: Config): any => {
                 // we check that the user still exists
                 let stillExists = false;
                 for (const authRole of config.authRoles) {
-                    const { rows } = await db.query("SELECT * FROM ?? WHERE ?? = ?", [authRole.table, authRole.idField, req.session.user.userId]);
+                    // Re-apply the role's `filters` here too, so an account that becomes
+                    // ineligible (e.g. deactivated) has its existing session invalidated
+                    // on its next request — not just blocked at login time.
+                    const filters = authRole.filters ? `AND ${authRole.filters}` : "";
+                    const { rows } = await db.query(`SELECT * FROM ?? WHERE ?? = ? ${filters}`, [authRole.table, authRole.idField, req.session.user.userId]);
                     if (rows.length > 0) {
                         stillExists = true;
                         break;
@@ -151,39 +155,7 @@ export default (config: Config): any => {
         }
     })
 
-    app.use("/api", (req, res, next) => {
-        return api(db, {
-            ...config,
-            views: config.views
-                .filter(x => !x.roles
-                    || (req.session.user && ([...(x.roles || []), ...(x.readRoles || [])].includes(req.session.user.role)))
-                )
-                .map(view => {
-                    const readOnly = req.session.user && view.roles && !view.roles.includes(req.session.user.role)
-                    if (readOnly) {
-                        return {
-                            ...view,
-                            canEdit: false,
-                            canCreate: false,
-                            canDelete: false,
-                            clickToEdit: false
-                        }
-                    } else {
-                        return view;
-                    }
-                })
-                .map(view => {
-                    if (view.type === "table") {
-                        return {
-                            ...view,
-                            columns: view.columns.filter(column => !column.roles || (req.session.user && column.roles.includes(req.session.user.role)))
-                        }
-                    } else {
-                        return view;
-                    }
-                })
-        }, req.session.user)(req, res, next)
-    })
+    app.use("/api", api(db, config))
 
     // Serve static files
     app.get("*", (req, res) => {

package/src/types/config.ts

@@ -429,6 +429,9 @@ export type AuthRole = {
 };
 
 export type Config = {
+  /** Ne pas renseigner !!! */
+  enriched?: boolean;
+
   /** Nom du projet */
   name: string;
 

package/src/utils/dbManager.ts

@@ -89,7 +89,10 @@ export default class dbManager {
                 port: config.mysql.port || 3306,
                 charset: 'UTF8MB4_GENERAL_CI',
                 dateStrings: true,
-                multipleStatements: true
+                // SECURITY: multi-statement queries let any SQL-injection escalate to stacked
+                // writes / DROP. Keep OFF by default; opt in explicitly only if a config truly
+                // relies on `;`-separated statements (none of galadmin's internal queries do).
+                multipleStatements: config.mysql.multipleStatements === true
             });
             this.dbType = "MYSQL";
         } else if (config.postgresql) {

package/tsconfig.json

@@ -1,6 +1,7 @@
 {
   "compilerOptions": {
     "module": "commonjs",
+    "skipLibCheck": true,
     "declaration": true,
     "removeComments": true,
     "emitDecoratorMetadata": true,