@galadrim/galadmin 0.1.235 → 0.2.6

package/src/front/ckeditor5-build/node_modules/.bin/semver

@@ -0,0 +1,12 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*|*MINGW*|*MSYS*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../semver/bin/semver.js" "$@"
+else 
+  exec node  "$basedir/../semver/bin/semver.js" "$@"
+fi

package/src/front/ckeditor5-build/node_modules/.bin/semver.cmd

@@ -0,0 +1,17 @@
+@ECHO off
+GOTO start
+:find_dp0
+SET dp0=%~dp0
+EXIT /b
+:start
+SETLOCAL
+CALL :find_dp0
+
+IF EXIST "%dp0%\node.exe" (
+  SET "_prog=%dp0%\node.exe"
+) ELSE (
+  SET "_prog=node"
+  SET PATHEXT=%PATHEXT:;.JS;=;%
+)
+
+endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%"  "%dp0%\..\semver\bin\semver.js" %*

package/src/front/ckeditor5-build/node_modules/.bin/semver.ps1

@@ -0,0 +1,28 @@
+#!/usr/bin/env pwsh
+$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent
+
+$exe=""
+if ($PSVersionTable.PSVersion -lt "6.0" -or $IsWindows) {
+  # Fix case when both the Windows and Linux builds of Node
+  # are installed in the same directory
+  $exe=".exe"
+}
+$ret=0
+if (Test-Path "$basedir/node$exe") {
+  # Support pipeline input
+  if ($MyInvocation.ExpectingInput) {
+    $input | & "$basedir/node$exe"  "$basedir/../semver/bin/semver.js" $args
+  } else {
+    & "$basedir/node$exe"  "$basedir/../semver/bin/semver.js" $args
+  }
+  $ret=$LASTEXITCODE
+} else {
+  # Support pipeline input
+  if ($MyInvocation.ExpectingInput) {
+    $input | & "node$exe"  "$basedir/../semver/bin/semver.js" $args
+  } else {
+    & "node$exe"  "$basedir/../semver/bin/semver.js" $args
+  }
+  $ret=$LASTEXITCODE
+}
+exit $ret

package/src/front/src/App.test.js

@@ -0,0 +1,28 @@
+import { render } from "@testing-library/react";
+import axios from "axios";
+import App from "./App";
+
+jest.mock("axios", () => ({
+  __esModule: true,
+  default: { defaults: {}, get: jest.fn(), post: jest.fn() },
+}));
+
+// RichTextInput patches window.Quill at module load; Quill only exists in
+// the real app via a CDN script tag.
+jest.mock("./components/inputs/RichTextInput", () => ({
+  __esModule: true,
+  default: () => null,
+}));
+
+// CRA's jest config resets mocks between tests, so behavior must be
+// (re)declared here rather than in the mock factory.
+beforeEach(() => {
+  axios.get.mockResolvedValue({ data: { isAuthenticated: false } });
+});
+
+describe("App", () => {
+  it("renders the login panel when the session is not authenticated", async () => {
+    const { findByText } = render(<App />);
+    expect(await findByText("Se connecter")).toBeTruthy();
+  });
+});

package/src/front/src/components/OutsideClickHandler.test.js

@@ -0,0 +1,53 @@
+import { render, fireEvent } from "@testing-library/react";
+import OutsideClickHandler from "./OutsideClickHandler";
+
+describe("OutsideClickHandler", () => {
+  it("renders its children", () => {
+    const { getByText } = render(
+      <OutsideClickHandler onOutsideClick={() => {}}>
+        <span>inner content</span>
+      </OutsideClickHandler>,
+    );
+    expect(getByText("inner content")).toBeTruthy();
+  });
+
+  it("does not fire when clicking inside", () => {
+    const onOutsideClick = jest.fn();
+    const { getByText } = render(
+      <OutsideClickHandler onOutsideClick={onOutsideClick}>
+        <span>inner</span>
+      </OutsideClickHandler>,
+    );
+    fireEvent.mouseDown(getByText("inner"));
+    expect(onOutsideClick).not.toHaveBeenCalled();
+  });
+
+  it("fires on a mousedown outside of the wrapper", () => {
+    const onOutsideClick = jest.fn();
+    const { getByText } = render(
+      <div>
+        <div data-testid="outside">outside</div>
+        <OutsideClickHandler onOutsideClick={onOutsideClick}>
+          <span>inner</span>
+        </OutsideClickHandler>
+      </div>,
+    );
+    fireEvent.mouseDown(getByText("outside"));
+    expect(onOutsideClick).toHaveBeenCalledTimes(1);
+  });
+
+  it("stops listening after unmount", () => {
+    const onOutsideClick = jest.fn();
+    const { unmount, getByText } = render(
+      <div>
+        <div>outside</div>
+        <OutsideClickHandler onOutsideClick={onOutsideClick}>
+          <span>inner</span>
+        </OutsideClickHandler>
+      </div>,
+    );
+    unmount();
+    fireEvent.mouseDown(document.body);
+    expect(onOutsideClick).not.toHaveBeenCalled();
+  });
+});

package/src/front/src/components/RedirectToFirstView.test.js

@@ -0,0 +1,38 @@
+import { render } from "@testing-library/react";
+import { MemoryRouter, Route, Switch } from "react-router-dom";
+import RedirectToFirstView from "./RedirectToFirstView";
+import { ConfigContext } from "../contexts/ConfigContext";
+
+function renderWithViews(views) {
+  return render(
+    <ConfigContext.Provider value={{ views }}>
+      <MemoryRouter initialEntries={["/"]}>
+        <Switch>
+          <Route exact path="/" component={RedirectToFirstView} />
+          <Route path="/records/0" render={() => <div>LANDING-records</div>} />
+          <Route path="/iframe/0" render={() => <div>LANDING-iframe</div>} />
+          <Route
+            path="/customView/0"
+            render={() => <div>LANDING-customView</div>}
+          />
+        </Switch>
+      </MemoryRouter>
+    </ConfigContext.Provider>,
+  );
+}
+
+describe("RedirectToFirstView", () => {
+  it.each([
+    ["table", "LANDING-records"],
+    ["iframe", "LANDING-iframe"],
+    ["custom", "LANDING-customView"],
+  ])("redirects a %s first view to its route", (type, landing) => {
+    const { getByText } = renderWithViews([{ type, label: "First" }]);
+    expect(getByText(landing)).toBeTruthy();
+  });
+
+  it("renders nothing when the config has no views", () => {
+    const { container } = renderWithViews([]);
+    expect(container.innerHTML).toBe("");
+  });
+});

package/src/front/src/utils/checkRequiredColumns.test.js

@@ -0,0 +1,46 @@
+import checkRequiredColumns from "./checkRequiredColumns";
+
+describe("checkRequiredColumns", () => {
+  beforeEach(() => {
+    global.window.swal = jest.fn();
+  });
+
+  const columns = [
+    { label: "Nom", name: "fruitName", required: true },
+    { label: "Note", name: "note", required: true },
+    { label: "Acidité", name: "acidity" },
+  ];
+
+  it("accepts data where every required column is filled", () => {
+    expect(
+      checkRequiredColumns(columns, { fruitName: "pomme", note: "ok" }),
+    ).toBe(true);
+    expect(global.window.swal).not.toHaveBeenCalled();
+  });
+
+  it("rejects data missing a required column and shows a message", () => {
+    expect(checkRequiredColumns(columns, { fruitName: "pomme", note: "" })).toBe(
+      false,
+    );
+    expect(global.window.swal).toHaveBeenCalledWith(
+      expect.objectContaining({
+        text: "Le champ requis Note n'a pas été rempli",
+      }),
+    );
+  });
+
+  it("uses the plural message when several required columns are missing", () => {
+    expect(checkRequiredColumns(columns, {})).toBe(false);
+    expect(global.window.swal).toHaveBeenCalledWith(
+      expect.objectContaining({
+        text: "Les champs requis Nom, Note n'ont pas été remplis",
+      }),
+    );
+  });
+
+  it("treats null as unfilled and optional columns as ignorable", () => {
+    expect(
+      checkRequiredColumns(columns, { fruitName: "pomme", note: "n", acidity: null }),
+    ).toBe(true);
+  });
+});

package/src/front/src/utils/evalExpression.test.js

@@ -0,0 +1,29 @@
+import evalExpression from "./evalExpression";
+
+describe("evalExpression", () => {
+  it("evaluates an arithmetic expression over the data", () => {
+    expect(evalExpression("a + b", { a: 1, b: 2 })).toBe(3);
+  });
+
+  it("interpolates string values", () => {
+    expect(
+      evalExpression("fruitName + ' !'", { fruitName: "pomme" }),
+    ).toBe("pomme !");
+  });
+
+  it("escapes single quotes in string data", () => {
+    expect(
+      evalExpression("name.toUpperCase()", { name: "l'orange" }),
+    ).toBe("L'ORANGE");
+  });
+
+  it("serializes object values", () => {
+    expect(evalExpression("obj.x", { obj: { x: 42 } })).toBe(42);
+  });
+
+  it("returns 'Error' for a broken expression instead of throwing", () => {
+    const consoleError = jest.spyOn(console, "error").mockImplementation();
+    expect(evalExpression("a +++", { a: 1 })).toBe("Error");
+    consoleError.mockRestore();
+  });
+});

package/src/index.ts

@@ -51,7 +51,7 @@ export default (config: Config): any => {
             }),
             createTableIfMissing: true,
             tableName: 'galadmin_sessions'
-        }) : new SessionStore({
+        }) : new (SessionStore(session))({
             schema: { tableName: 'galadmin_sessions' }
         }, mysql2.createPool({
             host: config.mysql.host,

package/src/utils/dbManager.ts

@@ -1,127 +1,273 @@
 import * as mysql from "mysql";
 import * as mysql2 from "mysql2";
-import * as pg from 'pg';
-
-function convertQuery(mysqlQuery, params) {
-    let pgQuery = '';
-    let pgParams = [];
-
-    let paramIndex = 1;
-    let charIndex = 0;
-
-    while (charIndex < mysqlQuery.length) {
-        if (mysqlQuery.charAt(charIndex) === '?' && mysqlQuery.charAt(charIndex + 1) === '?') {
-            // Replace "??"
-            pgQuery += params.shift();
-            charIndex += 2; // Skip two characters
-        } else if (mysqlQuery.charAt(charIndex) === '?') {
-            // Replace "?"
-            pgQuery += `$${paramIndex++}`;
-            pgParams.push(params.shift());
-            charIndex++; // Skip one character
+import * as pg from "pg";
+
+export function quoteIdentifier(name: string, dbType: string): string {
+  const quoteChar = dbType === "POSTGRESQL" ? '"' : "`";
+  return quoteChar + name + quoteChar;
+}
+
+function endOfLiteralOrComment(query: string, start: number): number {
+    const ch = query.charAt(start);
+    const next = query.charAt(start + 1);
+
+    if (ch === '-' && next === '-') {
+        const newline = query.indexOf('\n', start);
+        return newline === -1 ? query.length : newline;
+    }
+    if (ch === '/' && next === '*') {
+        const close = query.indexOf('*/', start + 2);
+        return close === -1 ? query.length : close + 2;
+    }
+    if (ch !== "'") {
+        return -1;
+    }
+
+    const prefix = query.charAt(start - 1);
+    const backslashEscapes = (prefix === 'E' || prefix === 'e') && !/[\w$]/.test(query.charAt(start - 2));
+
+    let index = start + 1;
+    while (index < query.length) {
+        const current = query.charAt(index);
+        if (backslashEscapes && current === '\\') {
+            index += 2;
+        } else if (current === "'" && query.charAt(index + 1) === "'") {
+            index += 2;
+        } else if (current === "'") {
+            return index + 1;
         } else {
-            pgQuery += mysqlQuery.charAt(charIndex);
-            charIndex++; // Go to next character
+            index++;
         }
     }
-
-    return {
-        pgQuery,
-        pgParams,
-    };
+    return query.length;
 }
 
-function quotePostgresQuery(query) {
-    query = query.replace(/`/g, '"');
+export function convertQuery(mysqlQuery, params) {
+  let pgQuery = "";
+  let pgParams = [];
 
-    const reservedWords = ["1","COUNT","*","UPDATE","SELECT","SET","=","INSERT","INTO","DELETE","FROM","WHERE","AND","OR","JOIN","ON","AS","IN","ILIKE","LIKE","EXISTS","ALL","ANY","NOT","NULL","TRUE","FALSE","GROUP","BY","ORDER","LIMIT","OFFSET","DESC","VALUES","LEFT","RIGHT","USING","CONCAT","CASE","WHEN","THEN","ELSE","END","ASC","IS","INTERVAL","CURRENT_DATE","SUM","COALESCE","-","ROUND","DATE_TRUNC","<>","+","DISTINCT","MAX","MIN","AVG","BIT_AND","BIT_OR","BOOL_AND","BOOL_OR","XMLAGG","STRING_AGG","EVERY","CORR","COVAR_POP","COVAR_SAMP","VAR_POP","VAR_SAMP","VARIANCE","REGR_SLOPE","REGR_INTERCEPT","REGR_COUNT","REGR_R2","REGR_AVGX","REGR_AVGY","REGR_SXX","REGR_SXY","REGR_SYY"];
+  let paramIndex = 1;
+  let charIndex = 0;
 
-    const wordsToAddQuotes = new Set()
-    const parts = query.split(/[ ,\(\)]/);
+  // Placeholders (`?` / `??`) only carry meaning OUTSIDE string literals:
+  // a literal `?` inside '…' must survive verbatim instead of being turned
+  // into a $N placeholder that would consume a parameter slot.
+  while (charIndex < mysqlQuery.length) {
+    const ch = mysqlQuery.charAt(charIndex);
+    const next = mysqlQuery.charAt(charIndex + 1);
+    const verbatimEnd = endOfLiteralOrComment(mysqlQuery, charIndex);
 
-    let inString = false;
+    if (verbatimEnd !== -1) {
+      pgQuery += mysqlQuery.slice(charIndex, verbatimEnd);
+      charIndex = verbatimEnd;
+    } else if (ch === "?" && next === "?") {
+      // Replace "??"
+      pgQuery += params.shift();
+      charIndex += 2; // Skip two characters
+    } else if (ch === "?") {
+      // Replace "?"
+      pgQuery += `$${paramIndex++}`;
+      pgParams.push(params.shift());
+      charIndex++; // Skip one character
+    } else {
+      pgQuery += ch;
+      charIndex++; // Go to next character
+    }
+  }
 
-    for (let i = 0; i < parts.length; i++) {
-        const part = parts[i].trim();
-        if (!part) {
-            continue
-        }
-        if (part.split(/['"]/).length % 2 === 0) {
-            inString = !inString;
-        }
+  return {
+    pgQuery,
+    pgParams,
+  };
+}
 
-        if (inString || part.startsWith("$") || part.includes("'") || part.includes('"') || reservedWords.includes(part.toUpperCase())) {
+export function quotePostgresQuery(query) {
+  query = query.replace(/`/g, '"');
 
-        } else {
-            for (let x of part.split(".")) {
-                if (isNaN(x)) {
-                    wordsToAddQuotes.add(x)
-                }
-            }
-        }
+  const reservedWords = [
+    "1",
+    "COUNT",
+    "*",
+    "UPDATE",
+    "SELECT",
+    "SET",
+    "=",
+    "INSERT",
+    "INTO",
+    "DELETE",
+    "FROM",
+    "WHERE",
+    "AND",
+    "OR",
+    "JOIN",
+    "ON",
+    "AS",
+    "IN",
+    "ILIKE",
+    "LIKE",
+    "EXISTS",
+    "ALL",
+    "ANY",
+    "NOT",
+    "NULL",
+    "TRUE",
+    "FALSE",
+    "GROUP",
+    "BY",
+    "ORDER",
+    "LIMIT",
+    "OFFSET",
+    "DESC",
+    "VALUES",
+    "LEFT",
+    "RIGHT",
+    "USING",
+    "CONCAT",
+    "CONCAT_WS",
+    "CASE",
+    "WHEN",
+    "THEN",
+    "ELSE",
+    "END",
+    "ASC",
+    "IS",
+    "INTERVAL",
+    "CURRENT_DATE",
+    "SUM",
+    "COALESCE",
+    "HAVING",
+    "WITH",
+    "-",
+    "ROUND",
+    "DATE_TRUNC",
+    "<>",
+    "+",
+    "DISTINCT",
+    "MAX",
+    "MIN",
+    "AVG",
+    "BIT_AND",
+    "BIT_OR",
+    "BOOL_AND",
+    "BOOL_OR",
+    "XMLAGG",
+    "STRING_AGG",
+    "EVERY",
+    "CORR",
+    "COVAR_POP",
+    "COVAR_SAMP",
+    "VAR_POP",
+    "VAR_SAMP",
+    "VARIANCE",
+    "REGR_SLOPE",
+    "REGR_INTERCEPT",
+    "REGR_COUNT",
+    "REGR_R2",
+    "REGR_AVGX",
+    "REGR_AVGY",
+    "REGR_SXX",
+    "REGR_SXY",
+    "REGR_SYY",
+    "CONFLICT",
+    "DO",
+    "EXCLUDED",
+    "RETURNING",
+  ];
+
+  const wordsToAddQuotes = new Set();
+  const parts = query.split(/[ ,\(\)]/);
+
+  let inString = false;
+
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i].trim();
+    if (!part) {
+      continue;
+    }
+    if (part.split(/['"]/).length % 2 === 0) {
+      inString = !inString;
     }
 
-    let newQuery = query;
-    for (let word of wordsToAddQuotes) {
-        if (word !== "*") {
-            newQuery = newQuery.replace(new RegExp(`(?<!["\'])\\b${word}\\b(?!["\'])`, 'g'), `"${word}"`)
+    if (
+      inString ||
+      part.startsWith("$") ||
+      part.includes("'") ||
+      part.includes('"') ||
+      reservedWords.includes(part.toUpperCase())
+    ) {
+    } else {
+      for (let x of part.split(".")) {
+        if (isNaN(x)) {
+          wordsToAddQuotes.add(x);
         }
+      }
     }
+  }
 
-    newQuery = newQuery.replace(/\) LIKE /g, ") ILIKE ");
-    newQuery = newQuery.replace(/ LIKE /g, "::text ILIKE ");
+  let newQuery = query;
+  for (let word of wordsToAddQuotes) {
+    if (word !== "*") {
+      newQuery = newQuery.replace(
+        new RegExp(`(?<!["\'])\\b${word}\\b(?!["\'])`, "g"),
+        `"${word}"`,
+      );
+    }
+  }
+
+  newQuery = newQuery.replace(/\) LIKE /g, ") ILIKE ");
+  newQuery = newQuery.replace(/ LIKE /g, "::text ILIKE ");
 
-    return newQuery;
+  return newQuery;
 }
 
 export default class dbManager {
-    _db;
-    dbType;
-
-    init(config) {
-        if (config.mysql) {
-            this._db = (config.useMysql2 ? mysql2 : mysql).createPool({
-                connectionLimit: 10,
-                host: config.mysql.host,
-                user: config.mysql.user,
-                password: config.mysql.password,
-                database: config.mysql.database,
-                port: config.mysql.port || 3306,
-                charset: 'UTF8MB4_GENERAL_CI',
-                dateStrings: true,
-                // SECURITY: multi-statement queries let any SQL-injection escalate to stacked
-                // writes / DROP. Keep OFF by default; opt in explicitly only if a config truly
-                // relies on `;`-separated statements (none of galadmin's internal queries do).
-                multipleStatements: config.mysql.multipleStatements === true
-            });
-            this.dbType = "MYSQL";
-        } else if (config.postgresql) {
-            this._db = new pg.Pool({
-                host: config.postgresql.host,
-                user: config.postgresql.user,
-                password: config.postgresql.password,
-                database: config.postgresql.database,
-                port: config.postgresql.port || 5432,
-                ssl: config.postgresql.ssl
-            });
-            this.dbType = "POSTGRESQL";
-        }
-    }
+  _db;
+  dbType;
 
-    async query(queryString, args = []): Promise<any> {
-        return new Promise((resolve, reject) => {
-            if (this.dbType === "POSTGRESQL") {
-                const result = convertQuery(queryString, args);
-                queryString = quotePostgresQuery(result.pgQuery);
-                args = result.pgParams;
-            }
-            this._db.query(queryString, args, (a, b, c) => {
-                if (this.dbType === "MYSQL") {
-                    resolve({ err: a, rows: b, fields: c })
-                } else if (this.dbType === "POSTGRESQL") {
-                    resolve({ err: a, rows: b?.rows, fields: b?.fields })
-                }
-            });
-        });
+  init(config) {
+    if (config.mysql) {
+      this._db = (config.useMysql2 ? mysql2 : mysql).createPool({
+        connectionLimit: 10,
+        host: config.mysql.host,
+        user: config.mysql.user,
+        password: config.mysql.password,
+        database: config.mysql.database,
+        port: config.mysql.port || 3306,
+        charset: "UTF8MB4_GENERAL_CI",
+        dateStrings: true,
+        // SECURITY: multi-statement queries let any SQL-injection escalate to stacked
+        // writes / DROP. Keep OFF by default; opt in explicitly only if a config truly
+        // relies on `;`-separated statements (none of galadmin's internal queries do).
+        multipleStatements: config.mysql.multipleStatements === true,
+      });
+      this.dbType = "MYSQL";
+    } else if (config.postgresql) {
+      this._db = new pg.Pool({
+        host: config.postgresql.host,
+        user: config.postgresql.user,
+        password: config.postgresql.password,
+        database: config.postgresql.database,
+        port: config.postgresql.port || 5432,
+        ssl: config.postgresql.ssl,
+      });
+      this.dbType = "POSTGRESQL";
     }
+  }
+
+  async query(queryString, args = []): Promise<any> {
+    return new Promise((resolve, reject) => {
+      if (this.dbType === "POSTGRESQL") {
+        const result = convertQuery(queryString, args);
+        queryString = quotePostgresQuery(result.pgQuery);
+        args = result.pgParams;
+      }
+      this._db.query(queryString, args, (a, b, c) => {
+        if (this.dbType === "MYSQL") {
+          resolve({ err: a, rows: b, fields: c });
+        } else if (this.dbType === "POSTGRESQL") {
+          resolve({ err: a, rows: b?.rows, fields: b?.fields });
+        }
+      });
+    });
+  }
 }