@galadrim/galadmin 0.1.236 → 0.2.7

package/src/front/src/components/OutsideClickHandler.test.js

@@ -0,0 +1,53 @@
+import { render, fireEvent } from "@testing-library/react";
+import OutsideClickHandler from "./OutsideClickHandler";
+
+describe("OutsideClickHandler", () => {
+  it("renders its children", () => {
+    const { getByText } = render(
+      <OutsideClickHandler onOutsideClick={() => {}}>
+        <span>inner content</span>
+      </OutsideClickHandler>,
+    );
+    expect(getByText("inner content")).toBeTruthy();
+  });
+
+  it("does not fire when clicking inside", () => {
+    const onOutsideClick = jest.fn();
+    const { getByText } = render(
+      <OutsideClickHandler onOutsideClick={onOutsideClick}>
+        <span>inner</span>
+      </OutsideClickHandler>,
+    );
+    fireEvent.mouseDown(getByText("inner"));
+    expect(onOutsideClick).not.toHaveBeenCalled();
+  });
+
+  it("fires on a mousedown outside of the wrapper", () => {
+    const onOutsideClick = jest.fn();
+    const { getByText } = render(
+      <div>
+        <div data-testid="outside">outside</div>
+        <OutsideClickHandler onOutsideClick={onOutsideClick}>
+          <span>inner</span>
+        </OutsideClickHandler>
+      </div>,
+    );
+    fireEvent.mouseDown(getByText("outside"));
+    expect(onOutsideClick).toHaveBeenCalledTimes(1);
+  });
+
+  it("stops listening after unmount", () => {
+    const onOutsideClick = jest.fn();
+    const { unmount, getByText } = render(
+      <div>
+        <div>outside</div>
+        <OutsideClickHandler onOutsideClick={onOutsideClick}>
+          <span>inner</span>
+        </OutsideClickHandler>
+      </div>,
+    );
+    unmount();
+    fireEvent.mouseDown(document.body);
+    expect(onOutsideClick).not.toHaveBeenCalled();
+  });
+});

package/src/front/src/components/RedirectToFirstView.test.js

@@ -0,0 +1,38 @@
+import { render } from "@testing-library/react";
+import { MemoryRouter, Route, Switch } from "react-router-dom";
+import RedirectToFirstView from "./RedirectToFirstView";
+import { ConfigContext } from "../contexts/ConfigContext";
+
+function renderWithViews(views) {
+  return render(
+    <ConfigContext.Provider value={{ views }}>
+      <MemoryRouter initialEntries={["/"]}>
+        <Switch>
+          <Route exact path="/" component={RedirectToFirstView} />
+          <Route path="/records/0" render={() => <div>LANDING-records</div>} />
+          <Route path="/iframe/0" render={() => <div>LANDING-iframe</div>} />
+          <Route
+            path="/customView/0"
+            render={() => <div>LANDING-customView</div>}
+          />
+        </Switch>
+      </MemoryRouter>
+    </ConfigContext.Provider>,
+  );
+}
+
+describe("RedirectToFirstView", () => {
+  it.each([
+    ["table", "LANDING-records"],
+    ["iframe", "LANDING-iframe"],
+    ["custom", "LANDING-customView"],
+  ])("redirects a %s first view to its route", (type, landing) => {
+    const { getByText } = renderWithViews([{ type, label: "First" }]);
+    expect(getByText(landing)).toBeTruthy();
+  });
+
+  it("renders nothing when the config has no views", () => {
+    const { container } = renderWithViews([]);
+    expect(container.innerHTML).toBe("");
+  });
+});

package/src/front/src/utils/checkRequiredColumns.test.js

@@ -0,0 +1,46 @@
+import checkRequiredColumns from "./checkRequiredColumns";
+
+describe("checkRequiredColumns", () => {
+  beforeEach(() => {
+    global.window.swal = jest.fn();
+  });
+
+  const columns = [
+    { label: "Nom", name: "fruitName", required: true },
+    { label: "Note", name: "note", required: true },
+    { label: "Acidité", name: "acidity" },
+  ];
+
+  it("accepts data where every required column is filled", () => {
+    expect(
+      checkRequiredColumns(columns, { fruitName: "pomme", note: "ok" }),
+    ).toBe(true);
+    expect(global.window.swal).not.toHaveBeenCalled();
+  });
+
+  it("rejects data missing a required column and shows a message", () => {
+    expect(checkRequiredColumns(columns, { fruitName: "pomme", note: "" })).toBe(
+      false,
+    );
+    expect(global.window.swal).toHaveBeenCalledWith(
+      expect.objectContaining({
+        text: "Le champ requis Note n'a pas été rempli",
+      }),
+    );
+  });
+
+  it("uses the plural message when several required columns are missing", () => {
+    expect(checkRequiredColumns(columns, {})).toBe(false);
+    expect(global.window.swal).toHaveBeenCalledWith(
+      expect.objectContaining({
+        text: "Les champs requis Nom, Note n'ont pas été remplis",
+      }),
+    );
+  });
+
+  it("treats null as unfilled and optional columns as ignorable", () => {
+    expect(
+      checkRequiredColumns(columns, { fruitName: "pomme", note: "n", acidity: null }),
+    ).toBe(true);
+  });
+});

package/src/front/src/utils/evalExpression.test.js

@@ -0,0 +1,29 @@
+import evalExpression from "./evalExpression";
+
+describe("evalExpression", () => {
+  it("evaluates an arithmetic expression over the data", () => {
+    expect(evalExpression("a + b", { a: 1, b: 2 })).toBe(3);
+  });
+
+  it("interpolates string values", () => {
+    expect(
+      evalExpression("fruitName + ' !'", { fruitName: "pomme" }),
+    ).toBe("pomme !");
+  });
+
+  it("escapes single quotes in string data", () => {
+    expect(
+      evalExpression("name.toUpperCase()", { name: "l'orange" }),
+    ).toBe("L'ORANGE");
+  });
+
+  it("serializes object values", () => {
+    expect(evalExpression("obj.x", { obj: { x: 42 } })).toBe(42);
+  });
+
+  it("returns 'Error' for a broken expression instead of throwing", () => {
+    const consoleError = jest.spyOn(console, "error").mockImplementation();
+    expect(evalExpression("a +++", { a: 1 })).toBe("Error");
+    consoleError.mockRestore();
+  });
+});

package/src/index.ts

@@ -51,7 +51,7 @@ export default (config: Config): any => {
             }),
             createTableIfMissing: true,
             tableName: 'galadmin_sessions'
-        }) : new SessionStore({
+        }) : new (SessionStore(session))({
             schema: { tableName: 'galadmin_sessions' }
         }, mysql2.createPool({
             host: config.mysql.host,
@@ -65,6 +65,26 @@ export default (config: Config): any => {
         name: 'galadmin.sid'
     }));
 
+    // trustedAuth: the host app (e.g. behind its own SSO) says who the user is, on every request.
+    // galadmin then has no login of its own: /api/login is refused, config.auth and authRoles are unused.
+    if (config.trustedAuth) {
+        app.use(async (req, res, next) => {
+            try {
+                const user = await config.trustedAuth(req);
+                if (user) {
+                    if (JSON.stringify(req.session.user) !== JSON.stringify(user)) {
+                        req.session.user = user;
+                    }
+                } else if (req.session.user) {
+                    delete req.session.user;
+                }
+                next();
+            } catch (err) {
+                next(err);
+            }
+        });
+    }
+
     const passwordMatch = async (password: string, hash: string, useArgon2: boolean) => {
         if (password === hash || bcrypt.compareSync(password, hash)) {
             return true;
@@ -81,7 +101,10 @@ export default (config: Config): any => {
     }
 
     app.post('/api/login', async (req, res) => {
-        if (req.body.username === config.auth.username && req.body.password === config.auth.password) {
+        if (config.trustedAuth) {
+            return res.send({ success: false })
+        }
+        if (config.auth && req.body.username === config.auth.username && req.body.password === config.auth.password) {
             req.session.user = { role: "root" }
             res.send({ success: true })
         } else if (config.authRoles) {
@@ -126,7 +149,7 @@ export default (config: Config): any => {
 
     app.use("/api", async (req, res, next) => {
         if (req.method === "OPTIONS" || req.session.user) {
-            if (req.session?.user?.userId) {
+            if (req.session?.user?.userId && !config.trustedAuth) {
                 // we check that the user still exists
                 let stillExists = false;
                 for (const authRole of config.authRoles) {

package/src/types/config.ts

@@ -428,6 +428,11 @@ export type AuthRole = {
   useArgon2?: boolean;
 };
 
+export type TrustedUser = {
+  role: string;
+  userId?: string | number;
+};
+
 export type Config = {
   /** Ne pas renseigner !!! */
   enriched?: boolean;
@@ -440,8 +445,15 @@ export type Config = {
 
   useMysql2?: boolean;
 
+  /**
+   * Authentification déléguée à l'application hôte (par exemple derrière son SSO) : appelée à chaque
+   * requête, renvoie l'utilisateur (`role`, et `userId` pour la traçabilité) ou null. Quand elle est
+   * définie, galadmin n'a plus de login propre : `auth` et `authRoles` ne servent plus.
+   */
+  trustedAuth?: (req: any) => TrustedUser | null | Promise<TrustedUser | null>;
+
   /** Identifiants permettant d'accéder au back-office */
-  auth: {
+  auth?: {
     /** Nom d'utilisateur */
     username: string;
 

package/src/utils/dbManager.ts

@@ -1,132 +1,273 @@
 import * as mysql from "mysql";
 import * as mysql2 from "mysql2";
-import * as pg from 'pg';
+import * as pg from "pg";
 
 export function quoteIdentifier(name: string, dbType: string): string {
-  const quoteChar = dbType === "POSTGRESQL" ? '"' : '`';
+  const quoteChar = dbType === "POSTGRESQL" ? '"' : "`";
   return quoteChar + name + quoteChar;
 }
 
-function convertQuery(mysqlQuery, params) {
-    let pgQuery = '';
-    let pgParams = [];
-
-    let paramIndex = 1;
-    let charIndex = 0;
-
-    while (charIndex < mysqlQuery.length) {
-        if (mysqlQuery.charAt(charIndex) === '?' && mysqlQuery.charAt(charIndex + 1) === '?') {
-            // Replace "??"
-            pgQuery += params.shift();
-            charIndex += 2; // Skip two characters
-        } else if (mysqlQuery.charAt(charIndex) === '?') {
-            // Replace "?"
-            pgQuery += `$${paramIndex++}`;
-            pgParams.push(params.shift());
-            charIndex++; // Skip one character
+function endOfLiteralOrComment(query: string, start: number): number {
+    const ch = query.charAt(start);
+    const next = query.charAt(start + 1);
+
+    if (ch === '-' && next === '-') {
+        const newline = query.indexOf('\n', start);
+        return newline === -1 ? query.length : newline;
+    }
+    if (ch === '/' && next === '*') {
+        const close = query.indexOf('*/', start + 2);
+        return close === -1 ? query.length : close + 2;
+    }
+    if (ch !== "'") {
+        return -1;
+    }
+
+    const prefix = query.charAt(start - 1);
+    const backslashEscapes = (prefix === 'E' || prefix === 'e') && !/[\w$]/.test(query.charAt(start - 2));
+
+    let index = start + 1;
+    while (index < query.length) {
+        const current = query.charAt(index);
+        if (backslashEscapes && current === '\\') {
+            index += 2;
+        } else if (current === "'" && query.charAt(index + 1) === "'") {
+            index += 2;
+        } else if (current === "'") {
+            return index + 1;
         } else {
-            pgQuery += mysqlQuery.charAt(charIndex);
-            charIndex++; // Go to next character
+            index++;
         }
     }
-
-    return {
-        pgQuery,
-        pgParams,
-    };
+    return query.length;
 }
 
-function quotePostgresQuery(query) {
-    query = query.replace(/`/g, '"');
+export function convertQuery(mysqlQuery, params) {
+  let pgQuery = "";
+  let pgParams = [];
 
-    const reservedWords = ["1","COUNT","*","UPDATE","SELECT","SET","=","INSERT","INTO","DELETE","FROM","WHERE","AND","OR","JOIN","ON","AS","IN","ILIKE","LIKE","EXISTS","ALL","ANY","NOT","NULL","TRUE","FALSE","GROUP","BY","ORDER","LIMIT","OFFSET","DESC","VALUES","LEFT","RIGHT","USING","CONCAT","CASE","WHEN","THEN","ELSE","END","ASC","IS","INTERVAL","CURRENT_DATE","SUM","COALESCE","-","ROUND","DATE_TRUNC","<>","+","DISTINCT","MAX","MIN","AVG","BIT_AND","BIT_OR","BOOL_AND","BOOL_OR","XMLAGG","STRING_AGG","EVERY","CORR","COVAR_POP","COVAR_SAMP","VAR_POP","VAR_SAMP","VARIANCE","REGR_SLOPE","REGR_INTERCEPT","REGR_COUNT","REGR_R2","REGR_AVGX","REGR_AVGY","REGR_SXX","REGR_SXY","REGR_SYY"];
+  let paramIndex = 1;
+  let charIndex = 0;
 
-    const wordsToAddQuotes = new Set()
-    const parts = query.split(/[ ,\(\)]/);
+  // Placeholders (`?` / `??`) only carry meaning OUTSIDE string literals:
+  // a literal `?` inside '…' must survive verbatim instead of being turned
+  // into a $N placeholder that would consume a parameter slot.
+  while (charIndex < mysqlQuery.length) {
+    const ch = mysqlQuery.charAt(charIndex);
+    const next = mysqlQuery.charAt(charIndex + 1);
+    const verbatimEnd = endOfLiteralOrComment(mysqlQuery, charIndex);
 
-    let inString = false;
+    if (verbatimEnd !== -1) {
+      pgQuery += mysqlQuery.slice(charIndex, verbatimEnd);
+      charIndex = verbatimEnd;
+    } else if (ch === "?" && next === "?") {
+      // Replace "??"
+      pgQuery += params.shift();
+      charIndex += 2; // Skip two characters
+    } else if (ch === "?") {
+      // Replace "?"
+      pgQuery += `$${paramIndex++}`;
+      pgParams.push(params.shift());
+      charIndex++; // Skip one character
+    } else {
+      pgQuery += ch;
+      charIndex++; // Go to next character
+    }
+  }
 
-    for (let i = 0; i < parts.length; i++) {
-        const part = parts[i].trim();
-        if (!part) {
-            continue
-        }
-        if (part.split(/['"]/).length % 2 === 0) {
-            inString = !inString;
-        }
+  return {
+    pgQuery,
+    pgParams,
+  };
+}
 
-        if (inString || part.startsWith("$") || part.includes("'") || part.includes('"') || reservedWords.includes(part.toUpperCase())) {
+export function quotePostgresQuery(query) {
+  query = query.replace(/`/g, '"');
 
-        } else {
-            for (let x of part.split(".")) {
-                if (isNaN(x)) {
-                    wordsToAddQuotes.add(x)
-                }
-            }
-        }
+  const reservedWords = [
+    "1",
+    "COUNT",
+    "*",
+    "UPDATE",
+    "SELECT",
+    "SET",
+    "=",
+    "INSERT",
+    "INTO",
+    "DELETE",
+    "FROM",
+    "WHERE",
+    "AND",
+    "OR",
+    "JOIN",
+    "ON",
+    "AS",
+    "IN",
+    "ILIKE",
+    "LIKE",
+    "EXISTS",
+    "ALL",
+    "ANY",
+    "NOT",
+    "NULL",
+    "TRUE",
+    "FALSE",
+    "GROUP",
+    "BY",
+    "ORDER",
+    "LIMIT",
+    "OFFSET",
+    "DESC",
+    "VALUES",
+    "LEFT",
+    "RIGHT",
+    "USING",
+    "CONCAT",
+    "CONCAT_WS",
+    "CASE",
+    "WHEN",
+    "THEN",
+    "ELSE",
+    "END",
+    "ASC",
+    "IS",
+    "INTERVAL",
+    "CURRENT_DATE",
+    "SUM",
+    "COALESCE",
+    "HAVING",
+    "WITH",
+    "-",
+    "ROUND",
+    "DATE_TRUNC",
+    "<>",
+    "+",
+    "DISTINCT",
+    "MAX",
+    "MIN",
+    "AVG",
+    "BIT_AND",
+    "BIT_OR",
+    "BOOL_AND",
+    "BOOL_OR",
+    "XMLAGG",
+    "STRING_AGG",
+    "EVERY",
+    "CORR",
+    "COVAR_POP",
+    "COVAR_SAMP",
+    "VAR_POP",
+    "VAR_SAMP",
+    "VARIANCE",
+    "REGR_SLOPE",
+    "REGR_INTERCEPT",
+    "REGR_COUNT",
+    "REGR_R2",
+    "REGR_AVGX",
+    "REGR_AVGY",
+    "REGR_SXX",
+    "REGR_SXY",
+    "REGR_SYY",
+    "CONFLICT",
+    "DO",
+    "EXCLUDED",
+    "RETURNING",
+  ];
+
+  const wordsToAddQuotes = new Set();
+  const parts = query.split(/[ ,\(\)]/);
+
+  let inString = false;
+
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i].trim();
+    if (!part) {
+      continue;
+    }
+    if (part.split(/['"]/).length % 2 === 0) {
+      inString = !inString;
     }
 
-    let newQuery = query;
-    for (let word of wordsToAddQuotes) {
-        if (word !== "*") {
-            newQuery = newQuery.replace(new RegExp(`(?<!["\'])\\b${word}\\b(?!["\'])`, 'g'), `"${word}"`)
+    if (
+      inString ||
+      part.startsWith("$") ||
+      part.includes("'") ||
+      part.includes('"') ||
+      reservedWords.includes(part.toUpperCase())
+    ) {
+    } else {
+      for (let x of part.split(".")) {
+        if (isNaN(x)) {
+          wordsToAddQuotes.add(x);
         }
+      }
     }
+  }
 
-    newQuery = newQuery.replace(/\) LIKE /g, ") ILIKE ");
-    newQuery = newQuery.replace(/ LIKE /g, "::text ILIKE ");
+  let newQuery = query;
+  for (let word of wordsToAddQuotes) {
+    if (word !== "*") {
+      newQuery = newQuery.replace(
+        new RegExp(`(?<!["\'])\\b${word}\\b(?!["\'])`, "g"),
+        `"${word}"`,
+      );
+    }
+  }
 
-    return newQuery;
+  newQuery = newQuery.replace(/\) LIKE /g, ") ILIKE ");
+  newQuery = newQuery.replace(/ LIKE /g, "::text ILIKE ");
+
+  return newQuery;
 }
 
 export default class dbManager {
-    _db;
-    dbType;
-
-    init(config) {
-        if (config.mysql) {
-            this._db = (config.useMysql2 ? mysql2 : mysql).createPool({
-                connectionLimit: 10,
-                host: config.mysql.host,
-                user: config.mysql.user,
-                password: config.mysql.password,
-                database: config.mysql.database,
-                port: config.mysql.port || 3306,
-                charset: 'UTF8MB4_GENERAL_CI',
-                dateStrings: true,
-                // SECURITY: multi-statement queries let any SQL-injection escalate to stacked
-                // writes / DROP. Keep OFF by default; opt in explicitly only if a config truly
-                // relies on `;`-separated statements (none of galadmin's internal queries do).
-                multipleStatements: config.mysql.multipleStatements === true
-            });
-            this.dbType = "MYSQL";
-        } else if (config.postgresql) {
-            this._db = new pg.Pool({
-                host: config.postgresql.host,
-                user: config.postgresql.user,
-                password: config.postgresql.password,
-                database: config.postgresql.database,
-                port: config.postgresql.port || 5432,
-                ssl: config.postgresql.ssl
-            });
-            this.dbType = "POSTGRESQL";
-        }
-    }
+  _db;
+  dbType;
 
-    async query(queryString, args = []): Promise<any> {
-        return new Promise((resolve, reject) => {
-            if (this.dbType === "POSTGRESQL") {
-                const result = convertQuery(queryString, args);
-                queryString = quotePostgresQuery(result.pgQuery);
-                args = result.pgParams;
-            }
-            this._db.query(queryString, args, (a, b, c) => {
-                if (this.dbType === "MYSQL") {
-                    resolve({ err: a, rows: b, fields: c })
-                } else if (this.dbType === "POSTGRESQL") {
-                    resolve({ err: a, rows: b?.rows, fields: b?.fields })
-                }
-            });
-        });
+  init(config) {
+    if (config.mysql) {
+      this._db = (config.useMysql2 ? mysql2 : mysql).createPool({
+        connectionLimit: 10,
+        host: config.mysql.host,
+        user: config.mysql.user,
+        password: config.mysql.password,
+        database: config.mysql.database,
+        port: config.mysql.port || 3306,
+        charset: "UTF8MB4_GENERAL_CI",
+        dateStrings: true,
+        // SECURITY: multi-statement queries let any SQL-injection escalate to stacked
+        // writes / DROP. Keep OFF by default; opt in explicitly only if a config truly
+        // relies on `;`-separated statements (none of galadmin's internal queries do).
+        multipleStatements: config.mysql.multipleStatements === true,
+      });
+      this.dbType = "MYSQL";
+    } else if (config.postgresql) {
+      this._db = new pg.Pool({
+        host: config.postgresql.host,
+        user: config.postgresql.user,
+        password: config.postgresql.password,
+        database: config.postgresql.database,
+        port: config.postgresql.port || 5432,
+        ssl: config.postgresql.ssl,
+      });
+      this.dbType = "POSTGRESQL";
     }
+  }
+
+  async query(queryString, args = []): Promise<any> {
+    return new Promise((resolve, reject) => {
+      if (this.dbType === "POSTGRESQL") {
+        const result = convertQuery(queryString, args);
+        queryString = quotePostgresQuery(result.pgQuery);
+        args = result.pgParams;
+      }
+      this._db.query(queryString, args, (a, b, c) => {
+        if (this.dbType === "MYSQL") {
+          resolve({ err: a, rows: b, fields: c });
+        } else if (this.dbType === "POSTGRESQL") {
+          resolve({ err: a, rows: b?.rows, fields: b?.fields });
+        }
+      });
+    });
+  }
 }