@galadrim/galadmin 0.1.236 → 0.2.6

package/src/front/src/components/OutsideClickHandler.test.js

@@ -0,0 +1,53 @@
+import { render, fireEvent } from "@testing-library/react";
+import OutsideClickHandler from "./OutsideClickHandler";
+
+describe("OutsideClickHandler", () => {
+  it("renders its children", () => {
+    const { getByText } = render(
+      <OutsideClickHandler onOutsideClick={() => {}}>
+        <span>inner content</span>
+      </OutsideClickHandler>,
+    );
+    expect(getByText("inner content")).toBeTruthy();
+  });
+
+  it("does not fire when clicking inside", () => {
+    const onOutsideClick = jest.fn();
+    const { getByText } = render(
+      <OutsideClickHandler onOutsideClick={onOutsideClick}>
+        <span>inner</span>
+      </OutsideClickHandler>,
+    );
+    fireEvent.mouseDown(getByText("inner"));
+    expect(onOutsideClick).not.toHaveBeenCalled();
+  });
+
+  it("fires on a mousedown outside of the wrapper", () => {
+    const onOutsideClick = jest.fn();
+    const { getByText } = render(
+      <div>
+        <div data-testid="outside">outside</div>
+        <OutsideClickHandler onOutsideClick={onOutsideClick}>
+          <span>inner</span>
+        </OutsideClickHandler>
+      </div>,
+    );
+    fireEvent.mouseDown(getByText("outside"));
+    expect(onOutsideClick).toHaveBeenCalledTimes(1);
+  });
+
+  it("stops listening after unmount", () => {
+    const onOutsideClick = jest.fn();
+    const { unmount, getByText } = render(
+      <div>
+        <div>outside</div>
+        <OutsideClickHandler onOutsideClick={onOutsideClick}>
+          <span>inner</span>
+        </OutsideClickHandler>
+      </div>,
+    );
+    unmount();
+    fireEvent.mouseDown(document.body);
+    expect(onOutsideClick).not.toHaveBeenCalled();
+  });
+});

package/src/front/src/components/RedirectToFirstView.test.js

@@ -0,0 +1,38 @@
+import { render } from "@testing-library/react";
+import { MemoryRouter, Route, Switch } from "react-router-dom";
+import RedirectToFirstView from "./RedirectToFirstView";
+import { ConfigContext } from "../contexts/ConfigContext";
+
+function renderWithViews(views) {
+  return render(
+    <ConfigContext.Provider value={{ views }}>
+      <MemoryRouter initialEntries={["/"]}>
+        <Switch>
+          <Route exact path="/" component={RedirectToFirstView} />
+          <Route path="/records/0" render={() => <div>LANDING-records</div>} />
+          <Route path="/iframe/0" render={() => <div>LANDING-iframe</div>} />
+          <Route
+            path="/customView/0"
+            render={() => <div>LANDING-customView</div>}
+          />
+        </Switch>
+      </MemoryRouter>
+    </ConfigContext.Provider>,
+  );
+}
+
+describe("RedirectToFirstView", () => {
+  it.each([
+    ["table", "LANDING-records"],
+    ["iframe", "LANDING-iframe"],
+    ["custom", "LANDING-customView"],
+  ])("redirects a %s first view to its route", (type, landing) => {
+    const { getByText } = renderWithViews([{ type, label: "First" }]);
+    expect(getByText(landing)).toBeTruthy();
+  });
+
+  it("renders nothing when the config has no views", () => {
+    const { container } = renderWithViews([]);
+    expect(container.innerHTML).toBe("");
+  });
+});

package/src/front/src/utils/checkRequiredColumns.test.js

@@ -0,0 +1,46 @@
+import checkRequiredColumns from "./checkRequiredColumns";
+
+describe("checkRequiredColumns", () => {
+  beforeEach(() => {
+    global.window.swal = jest.fn();
+  });
+
+  const columns = [
+    { label: "Nom", name: "fruitName", required: true },
+    { label: "Note", name: "note", required: true },
+    { label: "Acidité", name: "acidity" },
+  ];
+
+  it("accepts data where every required column is filled", () => {
+    expect(
+      checkRequiredColumns(columns, { fruitName: "pomme", note: "ok" }),
+    ).toBe(true);
+    expect(global.window.swal).not.toHaveBeenCalled();
+  });
+
+  it("rejects data missing a required column and shows a message", () => {
+    expect(checkRequiredColumns(columns, { fruitName: "pomme", note: "" })).toBe(
+      false,
+    );
+    expect(global.window.swal).toHaveBeenCalledWith(
+      expect.objectContaining({
+        text: "Le champ requis Note n'a pas été rempli",
+      }),
+    );
+  });
+
+  it("uses the plural message when several required columns are missing", () => {
+    expect(checkRequiredColumns(columns, {})).toBe(false);
+    expect(global.window.swal).toHaveBeenCalledWith(
+      expect.objectContaining({
+        text: "Les champs requis Nom, Note n'ont pas été remplis",
+      }),
+    );
+  });
+
+  it("treats null as unfilled and optional columns as ignorable", () => {
+    expect(
+      checkRequiredColumns(columns, { fruitName: "pomme", note: "n", acidity: null }),
+    ).toBe(true);
+  });
+});

package/src/front/src/utils/evalExpression.test.js

@@ -0,0 +1,29 @@
+import evalExpression from "./evalExpression";
+
+describe("evalExpression", () => {
+  it("evaluates an arithmetic expression over the data", () => {
+    expect(evalExpression("a + b", { a: 1, b: 2 })).toBe(3);
+  });
+
+  it("interpolates string values", () => {
+    expect(
+      evalExpression("fruitName + ' !'", { fruitName: "pomme" }),
+    ).toBe("pomme !");
+  });
+
+  it("escapes single quotes in string data", () => {
+    expect(
+      evalExpression("name.toUpperCase()", { name: "l'orange" }),
+    ).toBe("L'ORANGE");
+  });
+
+  it("serializes object values", () => {
+    expect(evalExpression("obj.x", { obj: { x: 42 } })).toBe(42);
+  });
+
+  it("returns 'Error' for a broken expression instead of throwing", () => {
+    const consoleError = jest.spyOn(console, "error").mockImplementation();
+    expect(evalExpression("a +++", { a: 1 })).toBe("Error");
+    consoleError.mockRestore();
+  });
+});

package/src/index.ts

@@ -51,7 +51,7 @@ export default (config: Config): any => {
             }),
             createTableIfMissing: true,
             tableName: 'galadmin_sessions'
-        }) : new SessionStore({
+        }) : new (SessionStore(session))({
             schema: { tableName: 'galadmin_sessions' }
         }, mysql2.createPool({
             host: config.mysql.host,

package/src/utils/dbManager.ts

@@ -1,132 +1,273 @@
 import * as mysql from "mysql";
 import * as mysql2 from "mysql2";
-import * as pg from 'pg';
+import * as pg from "pg";
 
 export function quoteIdentifier(name: string, dbType: string): string {
-  const quoteChar = dbType === "POSTGRESQL" ? '"' : '`';
+  const quoteChar = dbType === "POSTGRESQL" ? '"' : "`";
   return quoteChar + name + quoteChar;
 }
 
-function convertQuery(mysqlQuery, params) {
-    let pgQuery = '';
-    let pgParams = [];
-
-    let paramIndex = 1;
-    let charIndex = 0;
-
-    while (charIndex < mysqlQuery.length) {
-        if (mysqlQuery.charAt(charIndex) === '?' && mysqlQuery.charAt(charIndex + 1) === '?') {
-            // Replace "??"
-            pgQuery += params.shift();
-            charIndex += 2; // Skip two characters
-        } else if (mysqlQuery.charAt(charIndex) === '?') {
-            // Replace "?"
-            pgQuery += `$${paramIndex++}`;
-            pgParams.push(params.shift());
-            charIndex++; // Skip one character
+function endOfLiteralOrComment(query: string, start: number): number {
+    const ch = query.charAt(start);
+    const next = query.charAt(start + 1);
+
+    if (ch === '-' && next === '-') {
+        const newline = query.indexOf('\n', start);
+        return newline === -1 ? query.length : newline;
+    }
+    if (ch === '/' && next === '*') {
+        const close = query.indexOf('*/', start + 2);
+        return close === -1 ? query.length : close + 2;
+    }
+    if (ch !== "'") {
+        return -1;
+    }
+
+    const prefix = query.charAt(start - 1);
+    const backslashEscapes = (prefix === 'E' || prefix === 'e') && !/[\w$]/.test(query.charAt(start - 2));
+
+    let index = start + 1;
+    while (index < query.length) {
+        const current = query.charAt(index);
+        if (backslashEscapes && current === '\\') {
+            index += 2;
+        } else if (current === "'" && query.charAt(index + 1) === "'") {
+            index += 2;
+        } else if (current === "'") {
+            return index + 1;
         } else {
-            pgQuery += mysqlQuery.charAt(charIndex);
-            charIndex++; // Go to next character
+            index++;
         }
     }
-
-    return {
-        pgQuery,
-        pgParams,
-    };
+    return query.length;
 }
 
-function quotePostgresQuery(query) {
-    query = query.replace(/`/g, '"');
+export function convertQuery(mysqlQuery, params) {
+  let pgQuery = "";
+  let pgParams = [];
 
-    const reservedWords = ["1","COUNT","*","UPDATE","SELECT","SET","=","INSERT","INTO","DELETE","FROM","WHERE","AND","OR","JOIN","ON","AS","IN","ILIKE","LIKE","EXISTS","ALL","ANY","NOT","NULL","TRUE","FALSE","GROUP","BY","ORDER","LIMIT","OFFSET","DESC","VALUES","LEFT","RIGHT","USING","CONCAT","CASE","WHEN","THEN","ELSE","END","ASC","IS","INTERVAL","CURRENT_DATE","SUM","COALESCE","-","ROUND","DATE_TRUNC","<>","+","DISTINCT","MAX","MIN","AVG","BIT_AND","BIT_OR","BOOL_AND","BOOL_OR","XMLAGG","STRING_AGG","EVERY","CORR","COVAR_POP","COVAR_SAMP","VAR_POP","VAR_SAMP","VARIANCE","REGR_SLOPE","REGR_INTERCEPT","REGR_COUNT","REGR_R2","REGR_AVGX","REGR_AVGY","REGR_SXX","REGR_SXY","REGR_SYY"];
+  let paramIndex = 1;
+  let charIndex = 0;
 
-    const wordsToAddQuotes = new Set()
-    const parts = query.split(/[ ,\(\)]/);
+  // Placeholders (`?` / `??`) only carry meaning OUTSIDE string literals:
+  // a literal `?` inside '…' must survive verbatim instead of being turned
+  // into a $N placeholder that would consume a parameter slot.
+  while (charIndex < mysqlQuery.length) {
+    const ch = mysqlQuery.charAt(charIndex);
+    const next = mysqlQuery.charAt(charIndex + 1);
+    const verbatimEnd = endOfLiteralOrComment(mysqlQuery, charIndex);
 
-    let inString = false;
+    if (verbatimEnd !== -1) {
+      pgQuery += mysqlQuery.slice(charIndex, verbatimEnd);
+      charIndex = verbatimEnd;
+    } else if (ch === "?" && next === "?") {
+      // Replace "??"
+      pgQuery += params.shift();
+      charIndex += 2; // Skip two characters
+    } else if (ch === "?") {
+      // Replace "?"
+      pgQuery += `$${paramIndex++}`;
+      pgParams.push(params.shift());
+      charIndex++; // Skip one character
+    } else {
+      pgQuery += ch;
+      charIndex++; // Go to next character
+    }
+  }
 
-    for (let i = 0; i < parts.length; i++) {
-        const part = parts[i].trim();
-        if (!part) {
-            continue
-        }
-        if (part.split(/['"]/).length % 2 === 0) {
-            inString = !inString;
-        }
+  return {
+    pgQuery,
+    pgParams,
+  };
+}
 
-        if (inString || part.startsWith("$") || part.includes("'") || part.includes('"') || reservedWords.includes(part.toUpperCase())) {
+export function quotePostgresQuery(query) {
+  query = query.replace(/`/g, '"');
 
-        } else {
-            for (let x of part.split(".")) {
-                if (isNaN(x)) {
-                    wordsToAddQuotes.add(x)
-                }
-            }
-        }
+  const reservedWords = [
+    "1",
+    "COUNT",
+    "*",
+    "UPDATE",
+    "SELECT",
+    "SET",
+    "=",
+    "INSERT",
+    "INTO",
+    "DELETE",
+    "FROM",
+    "WHERE",
+    "AND",
+    "OR",
+    "JOIN",
+    "ON",
+    "AS",
+    "IN",
+    "ILIKE",
+    "LIKE",
+    "EXISTS",
+    "ALL",
+    "ANY",
+    "NOT",
+    "NULL",
+    "TRUE",
+    "FALSE",
+    "GROUP",
+    "BY",
+    "ORDER",
+    "LIMIT",
+    "OFFSET",
+    "DESC",
+    "VALUES",
+    "LEFT",
+    "RIGHT",
+    "USING",
+    "CONCAT",
+    "CONCAT_WS",
+    "CASE",
+    "WHEN",
+    "THEN",
+    "ELSE",
+    "END",
+    "ASC",
+    "IS",
+    "INTERVAL",
+    "CURRENT_DATE",
+    "SUM",
+    "COALESCE",
+    "HAVING",
+    "WITH",
+    "-",
+    "ROUND",
+    "DATE_TRUNC",
+    "<>",
+    "+",
+    "DISTINCT",
+    "MAX",
+    "MIN",
+    "AVG",
+    "BIT_AND",
+    "BIT_OR",
+    "BOOL_AND",
+    "BOOL_OR",
+    "XMLAGG",
+    "STRING_AGG",
+    "EVERY",
+    "CORR",
+    "COVAR_POP",
+    "COVAR_SAMP",
+    "VAR_POP",
+    "VAR_SAMP",
+    "VARIANCE",
+    "REGR_SLOPE",
+    "REGR_INTERCEPT",
+    "REGR_COUNT",
+    "REGR_R2",
+    "REGR_AVGX",
+    "REGR_AVGY",
+    "REGR_SXX",
+    "REGR_SXY",
+    "REGR_SYY",
+    "CONFLICT",
+    "DO",
+    "EXCLUDED",
+    "RETURNING",
+  ];
+
+  const wordsToAddQuotes = new Set();
+  const parts = query.split(/[ ,\(\)]/);
+
+  let inString = false;
+
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i].trim();
+    if (!part) {
+      continue;
+    }
+    if (part.split(/['"]/).length % 2 === 0) {
+      inString = !inString;
     }
 
-    let newQuery = query;
-    for (let word of wordsToAddQuotes) {
-        if (word !== "*") {
-            newQuery = newQuery.replace(new RegExp(`(?<!["\'])\\b${word}\\b(?!["\'])`, 'g'), `"${word}"`)
+    if (
+      inString ||
+      part.startsWith("$") ||
+      part.includes("'") ||
+      part.includes('"') ||
+      reservedWords.includes(part.toUpperCase())
+    ) {
+    } else {
+      for (let x of part.split(".")) {
+        if (isNaN(x)) {
+          wordsToAddQuotes.add(x);
         }
+      }
     }
+  }
 
-    newQuery = newQuery.replace(/\) LIKE /g, ") ILIKE ");
-    newQuery = newQuery.replace(/ LIKE /g, "::text ILIKE ");
+  let newQuery = query;
+  for (let word of wordsToAddQuotes) {
+    if (word !== "*") {
+      newQuery = newQuery.replace(
+        new RegExp(`(?<!["\'])\\b${word}\\b(?!["\'])`, "g"),
+        `"${word}"`,
+      );
+    }
+  }
 
-    return newQuery;
+  newQuery = newQuery.replace(/\) LIKE /g, ") ILIKE ");
+  newQuery = newQuery.replace(/ LIKE /g, "::text ILIKE ");
+
+  return newQuery;
 }
 
 export default class dbManager {
-    _db;
-    dbType;
-
-    init(config) {
-        if (config.mysql) {
-            this._db = (config.useMysql2 ? mysql2 : mysql).createPool({
-                connectionLimit: 10,
-                host: config.mysql.host,
-                user: config.mysql.user,
-                password: config.mysql.password,
-                database: config.mysql.database,
-                port: config.mysql.port || 3306,
-                charset: 'UTF8MB4_GENERAL_CI',
-                dateStrings: true,
-                // SECURITY: multi-statement queries let any SQL-injection escalate to stacked
-                // writes / DROP. Keep OFF by default; opt in explicitly only if a config truly
-                // relies on `;`-separated statements (none of galadmin's internal queries do).
-                multipleStatements: config.mysql.multipleStatements === true
-            });
-            this.dbType = "MYSQL";
-        } else if (config.postgresql) {
-            this._db = new pg.Pool({
-                host: config.postgresql.host,
-                user: config.postgresql.user,
-                password: config.postgresql.password,
-                database: config.postgresql.database,
-                port: config.postgresql.port || 5432,
-                ssl: config.postgresql.ssl
-            });
-            this.dbType = "POSTGRESQL";
-        }
-    }
+  _db;
+  dbType;
 
-    async query(queryString, args = []): Promise<any> {
-        return new Promise((resolve, reject) => {
-            if (this.dbType === "POSTGRESQL") {
-                const result = convertQuery(queryString, args);
-                queryString = quotePostgresQuery(result.pgQuery);
-                args = result.pgParams;
-            }
-            this._db.query(queryString, args, (a, b, c) => {
-                if (this.dbType === "MYSQL") {
-                    resolve({ err: a, rows: b, fields: c })
-                } else if (this.dbType === "POSTGRESQL") {
-                    resolve({ err: a, rows: b?.rows, fields: b?.fields })
-                }
-            });
-        });
+  init(config) {
+    if (config.mysql) {
+      this._db = (config.useMysql2 ? mysql2 : mysql).createPool({
+        connectionLimit: 10,
+        host: config.mysql.host,
+        user: config.mysql.user,
+        password: config.mysql.password,
+        database: config.mysql.database,
+        port: config.mysql.port || 3306,
+        charset: "UTF8MB4_GENERAL_CI",
+        dateStrings: true,
+        // SECURITY: multi-statement queries let any SQL-injection escalate to stacked
+        // writes / DROP. Keep OFF by default; opt in explicitly only if a config truly
+        // relies on `;`-separated statements (none of galadmin's internal queries do).
+        multipleStatements: config.mysql.multipleStatements === true,
+      });
+      this.dbType = "MYSQL";
+    } else if (config.postgresql) {
+      this._db = new pg.Pool({
+        host: config.postgresql.host,
+        user: config.postgresql.user,
+        password: config.postgresql.password,
+        database: config.postgresql.database,
+        port: config.postgresql.port || 5432,
+        ssl: config.postgresql.ssl,
+      });
+      this.dbType = "POSTGRESQL";
     }
+  }
+
+  async query(queryString, args = []): Promise<any> {
+    return new Promise((resolve, reject) => {
+      if (this.dbType === "POSTGRESQL") {
+        const result = convertQuery(queryString, args);
+        queryString = quotePostgresQuery(result.pgQuery);
+        args = result.pgParams;
+      }
+      this._db.query(queryString, args, (a, b, c) => {
+        if (this.dbType === "MYSQL") {
+          resolve({ err: a, rows: b, fields: c });
+        } else if (this.dbType === "POSTGRESQL") {
+          resolve({ err: a, rows: b?.rows, fields: b?.fields });
+        }
+      });
+    });
+  }
 }

package/src/utils/imageDimensions.ts

@@ -0,0 +1,112 @@
+import { promises as fsPromises } from "fs";
+
+const PNG_SIGNATURE = Buffer.from([
+  0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a,
+]);
+
+// Enough to hold a PNG IHDR, a GIF logical screen descriptor or the JPEG
+// segments (APPn/EXIF can be large) preceding the SOFn frame header.
+const HEADER_LIMIT = 2 * 1024 * 1024;
+
+export type ImageDimensions = { width: number; height: number };
+
+async function readHeader(filePath: string): Promise<Buffer> {
+  const handle = await fsPromises.open(filePath, "r");
+  try {
+    const length = Math.min(HEADER_LIMIT, (await handle.stat()).size);
+    const buffer = Buffer.alloc(length);
+    await handle.read(buffer, 0, length, 0);
+    return buffer;
+  } finally {
+    await handle.close();
+  }
+}
+
+function parsePngDimensions(header: Buffer): ImageDimensions | null {
+  if (header.length < 24 || header.toString("latin1", 12, 16) !== "IHDR") {
+    return null;
+  }
+  const width = header.readUInt32BE(16);
+  const height = header.readUInt32BE(20);
+  return width > 0 && height > 0 ? { width, height } : null;
+}
+
+function parseGifDimensions(header: Buffer): ImageDimensions | null {
+  const signature = header.toString("latin1", 0, 6);
+  if (signature !== "GIF87a" && signature !== "GIF89a") {
+    return null;
+  }
+  const width = header.readUInt16LE(6);
+  const height = header.readUInt16LE(8);
+  return width > 0 && height > 0 ? { width, height } : null;
+}
+
+function parseJpegDimensions(header: Buffer): ImageDimensions | null {
+  let offset = 2;
+  while (offset + 4 <= header.length) {
+    if (header[offset] !== 0xff) {
+      return null;
+    }
+    const marker = header[offset + 1];
+    // Standalone markers (SOI, TEM, RST, EOI) carry no length field
+    if (
+      marker === 0x01 ||
+      marker === 0xd8 ||
+      marker === 0xd9 ||
+      (marker >= 0xd0 && marker <= 0xd7)
+    ) {
+      offset += 2;
+      continue;
+    }
+    // Start of scan: frame header must have appeared before this point
+    if (marker === 0xda || marker === 0xd9) {
+      return null;
+    }
+    const segmentLength = header.readUInt16BE(offset + 2);
+    if (segmentLength < 2) {
+      return null;
+    }
+    const isFrameHeader =
+      marker >= 0xc0 &&
+      marker <= 0xcf &&
+      marker !== 0xc4 && // DHT
+      marker !== 0xc8 && // JPG
+      marker !== 0xcc; // DAC
+    if (isFrameHeader) {
+      if (offset + 9 > header.length) {
+        return null;
+      }
+      const height = header.readUInt16BE(offset + 5);
+      const width = header.readUInt16BE(offset + 7);
+      return width > 0 && height > 0 ? { width, height } : null;
+    }
+    offset += 2 + segmentLength;
+  }
+  return null;
+}
+
+export async function getImageDimensions(
+  filePath: string,
+): Promise<ImageDimensions | null> {
+  let header: Buffer;
+  try {
+    header = await readHeader(filePath);
+  } catch {
+    return null;
+  }
+  if (header.length >= 8 && header.subarray(0, 8).equals(PNG_SIGNATURE)) {
+    return parsePngDimensions(header);
+  }
+  if (header.length >= 10 && header.toString("latin1", 0, 3) === "GIF") {
+    return parseGifDimensions(header);
+  }
+  if (
+    header.length >= 3 &&
+    header[0] === 0xff &&
+    header[1] === 0xd8 &&
+    header[2] === 0xff
+  ) {
+    return parseJpegDimensions(header);
+  }
+  return null;
+}

package/tests/__mocks__/@aws-sdk/client-s3.js

@@ -0,0 +1,6 @@
+const send = jest.fn().mockResolvedValue({});
+module.exports = {
+  S3Client: jest.fn(() => ({ send })),
+  PutObjectCommand: jest.fn((input) => ({ input })),
+  __send: send,
+};

package/tests/__mocks__/@aws-sdk/s3-request-presigner.js

@@ -0,0 +1,3 @@
+module.exports = {
+  getSignedUrl: jest.fn().mockResolvedValue("https://signed.example.com/put-object"),
+};