@galadrim/galadmin 0.1.236 → 0.2.7

package/src/utils/imageDimensions.ts

@@ -0,0 +1,112 @@
+import { promises as fsPromises } from "fs";
+
+const PNG_SIGNATURE = Buffer.from([
+  0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a,
+]);
+
+// Enough to hold a PNG IHDR, a GIF logical screen descriptor or the JPEG
+// segments (APPn/EXIF can be large) preceding the SOFn frame header.
+const HEADER_LIMIT = 2 * 1024 * 1024;
+
+export type ImageDimensions = { width: number; height: number };
+
+async function readHeader(filePath: string): Promise<Buffer> {
+  const handle = await fsPromises.open(filePath, "r");
+  try {
+    const length = Math.min(HEADER_LIMIT, (await handle.stat()).size);
+    const buffer = Buffer.alloc(length);
+    await handle.read(buffer, 0, length, 0);
+    return buffer;
+  } finally {
+    await handle.close();
+  }
+}
+
+function parsePngDimensions(header: Buffer): ImageDimensions | null {
+  if (header.length < 24 || header.toString("latin1", 12, 16) !== "IHDR") {
+    return null;
+  }
+  const width = header.readUInt32BE(16);
+  const height = header.readUInt32BE(20);
+  return width > 0 && height > 0 ? { width, height } : null;
+}
+
+function parseGifDimensions(header: Buffer): ImageDimensions | null {
+  const signature = header.toString("latin1", 0, 6);
+  if (signature !== "GIF87a" && signature !== "GIF89a") {
+    return null;
+  }
+  const width = header.readUInt16LE(6);
+  const height = header.readUInt16LE(8);
+  return width > 0 && height > 0 ? { width, height } : null;
+}
+
+function parseJpegDimensions(header: Buffer): ImageDimensions | null {
+  let offset = 2;
+  while (offset + 4 <= header.length) {
+    if (header[offset] !== 0xff) {
+      return null;
+    }
+    const marker = header[offset + 1];
+    // Standalone markers (SOI, TEM, RST, EOI) carry no length field
+    if (
+      marker === 0x01 ||
+      marker === 0xd8 ||
+      marker === 0xd9 ||
+      (marker >= 0xd0 && marker <= 0xd7)
+    ) {
+      offset += 2;
+      continue;
+    }
+    // Start of scan: frame header must have appeared before this point
+    if (marker === 0xda || marker === 0xd9) {
+      return null;
+    }
+    const segmentLength = header.readUInt16BE(offset + 2);
+    if (segmentLength < 2) {
+      return null;
+    }
+    const isFrameHeader =
+      marker >= 0xc0 &&
+      marker <= 0xcf &&
+      marker !== 0xc4 && // DHT
+      marker !== 0xc8 && // JPG
+      marker !== 0xcc; // DAC
+    if (isFrameHeader) {
+      if (offset + 9 > header.length) {
+        return null;
+      }
+      const height = header.readUInt16BE(offset + 5);
+      const width = header.readUInt16BE(offset + 7);
+      return width > 0 && height > 0 ? { width, height } : null;
+    }
+    offset += 2 + segmentLength;
+  }
+  return null;
+}
+
+export async function getImageDimensions(
+  filePath: string,
+): Promise<ImageDimensions | null> {
+  let header: Buffer;
+  try {
+    header = await readHeader(filePath);
+  } catch {
+    return null;
+  }
+  if (header.length >= 8 && header.subarray(0, 8).equals(PNG_SIGNATURE)) {
+    return parsePngDimensions(header);
+  }
+  if (header.length >= 10 && header.toString("latin1", 0, 3) === "GIF") {
+    return parseGifDimensions(header);
+  }
+  if (
+    header.length >= 3 &&
+    header[0] === 0xff &&
+    header[1] === 0xd8 &&
+    header[2] === 0xff
+  ) {
+    return parseJpegDimensions(header);
+  }
+  return null;
+}

package/tests/__mocks__/@aws-sdk/client-s3.js

@@ -0,0 +1,6 @@
+const send = jest.fn().mockResolvedValue({});
+module.exports = {
+  S3Client: jest.fn(() => ({ send })),
+  PutObjectCommand: jest.fn((input) => ({ input })),
+  __send: send,
+};

package/tests/__mocks__/@aws-sdk/s3-request-presigner.js

@@ -0,0 +1,3 @@
+module.exports = {
+  getSignedUrl: jest.fn().mockResolvedValue("https://signed.example.com/put-object"),
+};

package/tests/__mocks__/@google-cloud/storage.js

@@ -0,0 +1,7 @@
+const upload = jest.fn().mockResolvedValue([{}]);
+const bucket = jest.fn(() => ({ upload }));
+module.exports = {
+  Storage: jest.fn(() => ({ bucket })),
+  __bucket: bucket,
+  __upload: upload,
+};

package/tests/__mocks__/argon2.js

@@ -0,0 +1,3 @@
+module.exports = {
+  verify: jest.fn().mockResolvedValue(true),
+};

package/tests/__mocks__/axios.js

@@ -0,0 +1,7 @@
+const axios = {
+  get: jest.fn(),
+  post: jest.fn(),
+  put: jest.fn(),
+};
+module.exports = axios;
+module.exports.default = axios;

package/tests/__mocks__/connect-pg-simple.js

@@ -0,0 +1,24 @@
+// use the REAL express-session Store base class (provides createSession,
+// EventEmitter, regenerate) and only stub the storage round-trip
+const expressSession = require("express-session");
+
+function createStore() {
+  const sessions = {};
+  const store = new expressSession.Store();
+  store.get = (sid, cb) => cb(null, sessions[sid]);
+  store.set = (sid, sess, cb) => {
+    sessions[sid] = sess;
+    if (cb) cb();
+  };
+  store.destroy = (sid, cb) => {
+    delete sessions[sid];
+    if (cb) cb();
+  };
+  return store;
+}
+
+const storeConstructor = jest.fn(() => createStore());
+const PgSessionStore = jest.fn(() => storeConstructor);
+module.exports = PgSessionStore;
+module.exports.__PgSessionStore = PgSessionStore;
+module.exports.__storeConstructor = storeConstructor;

package/tests/__mocks__/express-mysql-session.js

@@ -0,0 +1,24 @@
+// use the REAL express-session Store base class (provides createSession,
+// EventEmitter, regenerate) and only stub the storage round-trip
+const expressSession = require("express-session");
+
+function createStore() {
+  const sessions = {};
+  const store = new expressSession.Store();
+  store.get = (sid, cb) => cb(null, sessions[sid]);
+  store.set = (sid, sess, cb) => {
+    sessions[sid] = sess;
+    if (cb) cb();
+  };
+  store.destroy = (sid, cb) => {
+    delete sessions[sid];
+    if (cb) cb();
+  };
+  return store;
+}
+
+const storeConstructor = jest.fn(() => createStore());
+const MySQLSessionStore = jest.fn(() => storeConstructor);
+module.exports = MySQLSessionStore;
+module.exports.__MySQLSessionStore = MySQLSessionStore;
+module.exports.__storeConstructor = storeConstructor;

package/tests/__mocks__/mysql2/promise.js

@@ -0,0 +1,3 @@
+module.exports = {
+  createPool: jest.fn(() => ({})),
+};

package/tests/__mocks__/pg.js

@@ -0,0 +1,3 @@
+module.exports = {
+  Pool: jest.fn(() => ({})),
+};

package/tests/__mocks__/rollup.js

@@ -0,0 +1,5 @@
+const generate = jest
+  .fn()
+  .mockResolvedValue({ output: [{ code: "// mocked bundle" }] });
+const rollup = jest.fn().mockResolvedValue({ generate });
+module.exports = { rollup, __generate: generate };

package/tests/__mocks__/ssh2-sftp-client.js

@@ -0,0 +1,10 @@
+const connect = jest.fn().mockResolvedValue(undefined);
+const fastPut = jest.fn().mockResolvedValue(undefined);
+const end = jest.fn().mockResolvedValue(undefined);
+
+function SftpClient() {
+  return { connect, fastPut, end };
+}
+
+module.exports = SftpClient;
+module.exports.__sftp = { connect, fastPut, end };

package/tests/api-helpers.test.ts

@@ -0,0 +1,376 @@
+import {
+  generateUniqueIdForObject,
+  roleOf,
+  canWriteView,
+  viewFromRequest,
+  MUTATING_VIEW_ROUTES,
+  areSafeColumnNames,
+  writableTables,
+  looksLikeSqlBreakout,
+  sqlAnd,
+  evalExpression,
+  getFormattedValue,
+  formatValueForInsertion,
+  collectAllowedQueries,
+  enrichConfig,
+  enrichColumn,
+} from "../src/api";
+import { FakeDb } from "./helpers/fakeDb";
+import { baseConfig, schemaRow } from "./helpers/fixtures";
+
+describe("generateUniqueIdForObject", () => {
+  it("returns a stable 64-char sha256 hex id", () => {
+    const obj = { label: "Fruits", type: "table" };
+    const id = generateUniqueIdForObject(obj);
+    expect(id).toMatch(/^[a-f0-9]{64}$/);
+    expect(generateUniqueIdForObject(obj)).toBe(id);
+  });
+
+  it("differs for different objects", () => {
+    expect(generateUniqueIdForObject({ a: 1 })).not.toBe(
+      generateUniqueIdForObject({ a: 2 }),
+    );
+  });
+});
+
+describe("roleOf", () => {
+  it("reads the session user role", () => {
+    expect(roleOf({ session: { user: { role: "editor" } } })).toBe("editor");
+  });
+  it("returns undefined without a session", () => {
+    expect(roleOf({})).toBeUndefined();
+    expect(roleOf({ session: {} })).toBeUndefined();
+  });
+});
+
+describe("canWriteView", () => {
+  it("always allows root", () => {
+    expect(canWriteView({ roles: ["editor"] }, "root")).toBe(true);
+  });
+  it("allows views without roles", () => {
+    expect(canWriteView({}, "editor")).toBe(true);
+    expect(canWriteView(undefined, "editor")).toBe(true);
+  });
+  it("allows roles listed in view.roles", () => {
+    expect(canWriteView({ roles: ["editor", "viewer"] }, "editor")).toBe(true);
+  });
+  it("rejects roles not listed", () => {
+    expect(canWriteView({ roles: ["editor"] }, "viewer")).toBe(false);
+  });
+});
+
+describe("viewFromRequest", () => {
+  it("resolves the view from body.viewIndex", () => {
+    const req = { body: { viewIndex: 1 }, config: { views: ["a", "b"] } };
+    expect(viewFromRequest(req)).toBe("b");
+  });
+  it("resolves the view from query.viewIndex", () => {
+    const req = { query: { viewIndex: "0" }, config: { views: ["a", "b"] } };
+    expect(viewFromRequest(req)).toBe("a");
+  });
+  it("returns undefined without a config or index", () => {
+    expect(viewFromRequest({ body: {} })).toBeUndefined();
+    expect(viewFromRequest({ body: { viewIndex: 0 }, config: {} })).toBeUndefined();
+  });
+});
+
+describe("MUTATING_VIEW_ROUTES", () => {
+  it("covers every mutating view route", () => {
+    expect([...MUTATING_VIEW_ROUTES].sort()).toEqual(
+      [
+        "/customAction",
+        "/createRecord",
+        "/deleteRecord",
+        "/deleteRecordFromPanel",
+        "/deleteRecords",
+        "/updateRecord",
+        "/uploadFile",
+      ].sort(),
+    );
+  });
+});
+
+describe("areSafeColumnNames", () => {
+  it("accepts plain identifiers", () => {
+    expect(areSafeColumnNames({ fruitName: "a", acidity2: 1 })).toBe(true);
+  });
+  it("accepts empty/missing data", () => {
+    expect(areSafeColumnNames({})).toBe(true);
+    expect(areSafeColumnNames(undefined)).toBe(true);
+    expect(areSafeColumnNames(null)).toBe(true);
+  });
+  it("rejects SQL-breaking keys", () => {
+    expect(areSafeColumnNames({ "a;b": 1 })).toBe(false);
+    expect(areSafeColumnNames({ "a b": 1 })).toBe(false);
+    expect(areSafeColumnNames({ "a-b": 1 })).toBe(false);
+    expect(areSafeColumnNames({ "`a`": 1 })).toBe(false);
+    expect(areSafeColumnNames({ "a'": 1 })).toBe(false);
+  });
+});
+
+describe("writableTables", () => {
+  const config = {
+    views: [
+      {
+        tableName: "fruits",
+        roles: ["editor"],
+        recordViewPanels: [
+          { tableName: "fruit_notes" },
+          { createConfig: { tableName: "fruit_tags" } },
+        ],
+      },
+      { tableName: "open_table" },
+    ],
+  };
+  it("collects writable view + panel tables for the role", () => {
+    const req = { config, session: { user: { role: "editor" } } };
+    expect([...writableTables(req)].sort()).toEqual([
+      "fruit_notes",
+      "fruit_tags",
+      "fruits",
+      "open_table",
+    ]);
+  });
+  it("only collects unrole'd tables for an unknown role", () => {
+    const req = { config, session: { user: { role: "stranger" } } };
+    expect([...writableTables(req)]).toEqual(["open_table"]);
+  });
+  it("an unrole'd view is writable by any role", () => {
+    const req = { config, session: { user: { role: "editor" } } };
+    expect(writableTables(req).has("open_table")).toBe(true);
+  });
+});
+
+describe("looksLikeSqlBreakout", () => {
+  it("rejects every blocked pattern", () => {
+    const attacks = [
+      "1=1; DROP TABLE fruits",
+      "1=1 -- comment",
+      "1=1 /* c */",
+      "a UNION SELECT b",
+      "x INTO OUTFILE '/tmp/f'",
+      "x INTO DUMPFILE '/tmp/f'",
+      "SLEEP(10)",
+      "BENCHMARK(1000, MD5('a'))",
+      "LOAD_FILE('/etc/passwd')",
+    ];
+    for (const a of attacks) {
+      expect(looksLikeSqlBreakout(a)).toBe(true);
+    }
+  });
+  it("accepts ordinary filter fragments", () => {
+    expect(looksLikeSqlBreakout("age < 50 AND name = 'pomme'")).toBe(false);
+    expect(looksLikeSqlBreakout("price > 10.5")).toBe(false);
+  });
+  it("ignores non-strings", () => {
+    expect(looksLikeSqlBreakout(undefined)).toBe(false);
+    expect(looksLikeSqlBreakout(42)).toBe(false);
+  });
+});
+
+describe("sqlAnd", () => {
+  it("joins non-empty conditions with AND, each parenthesized", () => {
+    expect(sqlAnd(["a = 1", "b = 2"])).toBe("(a = 1) AND (b = 2)");
+  });
+  it("returns the single condition as-is", () => {
+    expect(sqlAnd(["a = 1"])).toBe("a = 1");
+  });
+  it("skips falsy/empty conditions", () => {
+    expect(sqlAnd([null, "", "a = 1", undefined])).toBe("a = 1");
+  });
+  it("returns null when nothing remains", () => {
+    expect(sqlAnd([null, ""])).toBeNull();
+    expect(sqlAnd([])).toBeNull();
+  });
+});
+
+describe("evalExpression", () => {
+  it("evaluates an expression against record fields", () => {
+    expect(
+      evalExpression("weight + ' kg'", { weight: 42 }),
+    ).toBe("42 kg");
+  });
+  it("handles object fields via JSON", () => {
+    expect(evalExpression("user.name", { user: { name: "bob" } })).toBe("bob");
+  });
+  it("escapes quotes and strips newlines in strings", () => {
+    expect(
+      evalExpression("text", { text: "l'orange" }),
+    ).toBe("l'orange");
+    expect(evalExpression("text", { text: "a\nb" })).toBe("ab");
+  });
+  it("returns 'Error' when evaluation fails", () => {
+    expect(evalExpression("notAVar + 1", {})).toBe("Error");
+  });
+});
+
+describe("getFormattedValue", () => {
+  it("prefers formatValueForExport", async () => {
+    const column = {
+      name: "a",
+      formatValueForExport: () => "export",
+      formatValue: () => "display",
+    };
+    await expect(getFormattedValue(column, { a: 1 })).resolves.toBe("export");
+  });
+  it("then formattedValue (evaluated)", async () => {
+    const column = { name: "a", formattedValue: "a + '!'" };
+    await expect(getFormattedValue(column, { a: "x" })).resolves.toBe("x!");
+  });
+  it("then formatValue", async () => {
+    const column = { name: "a", formatValue: (r: any) => r.a + "?" };
+    await expect(getFormattedValue(column, { a: "x" })).resolves.toBe("x?");
+  });
+  it("tinyint renders Oui/Non", async () => {
+    await expect(getFormattedValue({ dataType: "tinyint", name: "a" }, { a: 1 })).resolves.toBe("Oui");
+    await expect(getFormattedValue({ dataType: "tinyint", name: "a" }, { a: 0 })).resolves.toBe("Non");
+  });
+  it("falls back to the raw value", async () => {
+    await expect(getFormattedValue({ name: "a" }, { a: "raw" })).resolves.toBe("raw");
+  });
+  it("renders null/undefined as empty string", async () => {
+    await expect(getFormattedValue({ name: "a" }, {})).resolves.toBe("");
+    await expect(getFormattedValue({ name: "a" }, { a: null })).resolves.toBe("");
+  });
+  it("exposes column.options on the record (documented mutation)", async () => {
+    const record: any = {};
+    await getFormattedValue({ name: "a", options: ["x"] }, record);
+    expect(record.options).toEqual(["x"]);
+  });
+});
+
+describe("formatValueForInsertion", () => {
+  it("maps falsy (but not 0) to NULL", () => {
+    expect(formatValueForInsertion(null, "MYSQL")).toBe("NULL");
+    expect(formatValueForInsertion(undefined, "MYSQL")).toBe("NULL");
+    expect(formatValueForInsertion("", "MYSQL")).toBe("NULL");
+    expect(formatValueForInsertion(false, "MYSQL")).toBe("NULL");
+    expect(formatValueForInsertion(0, "MYSQL")).toBe(0);
+  });
+  it("serializes dates as ISO", () => {
+    const d = new Date("2024-01-02T03:04:05.000Z");
+    expect(formatValueForInsertion(d, "MYSQL")).toBe("2024-01-02T03:04:05.000Z");
+  });
+  it("quotes strings with dialect-appropriate escaping", () => {
+    expect(formatValueForInsertion("l'orange", "MYSQL")).toBe("'l\\'orange'");
+    expect(formatValueForInsertion("l'orange", "POSTGRESQL")).toBe("'l''orange'");
+  });
+  it("serializes objects as JSON literals", () => {
+    expect(formatValueForInsertion({ a: "b'c" }, "MYSQL")).toBe(
+      '\'{"a":"b\\\'c"}\'',
+    );
+  });
+  it("serializes booleans as TRUE (false is swallowed as NULL — documented quirk)", () => {
+    expect(formatValueForInsertion(true, "MYSQL")).toBe("TRUE");
+    expect(formatValueForInsertion(false, "POSTGRESQL")).toBe("NULL");
+  });
+  it("passes numbers through", () => {
+    expect(formatValueForInsertion(12.5, "MYSQL")).toBe(12.5);
+  });
+});
+
+describe("collectAllowedQueries", () => {
+  it("collects `query` and *Query string props recursively", () => {
+    const config = {
+      views: [
+        {
+          recordViewPanels: [
+            { query: "  SELECT 1  " },
+            { notificationBadge: { query: "SELECT 2" } },
+          ],
+        },
+        { columns: [{ autocompleteListQuery: "SELECT 3" }] },
+      ],
+    };
+    expect(collectAllowedQueries(config)).toEqual(
+      new Set(["SELECT 1", "SELECT 2", "SELECT 3"]),
+    );
+  });
+  it("ignores non-string and non-matching values", () => {
+    expect(collectAllowedQueries({ query: 42, queryString: "no" })).toEqual(
+      new Set(),
+    );
+  });
+});
+
+describe("enrichConfig", () => {
+  it("resolves primaryId from PRI columns and flags the config enriched", async () => {
+    const db = new FakeDb();
+    db.schemaRows = [
+      schemaRow("fruits", "id", { primary: true, dataType: "int" }),
+    ];
+    const config = baseConfig();
+    await enrichConfig(config, db);
+    expect(config.views[0].primaryId).toBe("id");
+    expect(config.enriched).toBe(true);
+    expect(config.views[0].__id__).toMatch(/^[a-f0-9]{64}$/);
+  });
+
+  it("does nothing on db error", async () => {
+    const db = new FakeDb();
+    // information_schema is intercepted, so simulate the error there
+    const origQuery = db.query.bind(db);
+    db.query = async (sql: string) => {
+      if (sql.includes("information_schema")) {
+        return { err: new Error("boom"), rows: null };
+      }
+      return origQuery(sql);
+    };
+    const config = baseConfig();
+    await enrichConfig(config, db);
+    expect(config.enriched).toBeUndefined();
+    expect(config.views[0].primaryId).toBeUndefined();
+  });
+});
+
+describe("enrichColumn", () => {
+  const info = [
+    schemaRow("fruits", "title", { nullable: false, dataType: "varchar" }),
+    schemaRow("fruits", "state", { dataType: "enum", columnType: "enum('a','b')" }),
+    schemaRow("fruits", "body", { nullable: true, dataType: "text" }),
+  ];
+
+  it("assigns an __id__ and infers dataType + required from the schema", () => {
+    const column: any = { label: "Titre", name: "title" };
+    enrichColumn(column, "fruits", info);
+    expect(column.__id__).toMatch(/^[a-f0-9]{64}$/);
+    expect(column.dataType).toBe("varchar");
+    expect(column.required).toBe(true);
+  });
+
+  it("does not force required on nullable/text columns", () => {
+    const column: any = { label: "Body", name: "body" };
+    enrichColumn(column, "fruits", info);
+    expect(column.required).toBeUndefined();
+  });
+
+  it("converts enum columns to select with parsed options", () => {
+    const column: any = { label: "State", name: "state" };
+    enrichColumn(column, "fruits", info);
+    expect(column.dataType).toBe("select");
+    expect(column.options).toEqual(["a", "b"]);
+  });
+
+  it("rewrites richText column names to the content field", () => {
+    const column: any = { label: "Body", dataType: "richText", htmlField: "html", contentField: "body" };
+    enrichColumn(column, "fruits", info);
+    expect(column.name).toBe("body");
+  });
+
+  it("adds a baseUrl for file columns with s3/gcp config", () => {
+    const column: any = {
+      label: "Img",
+      dataType: "file",
+      name: "img",
+      s3Config: { host: "s3.example.com", bucket: "b" },
+    };
+    enrichColumn(column, "fruits", info);
+    expect(column.baseUrl).toBe("https://s3.example.com/b/");
+  });
+
+  it("keeps explicit dataType when the schema has an unknown column", () => {
+    const column: any = { label: "X", name: "ghost", dataType: "select" };
+    enrichColumn(column, "fruits", info);
+    expect(column.dataType).toBe("select");
+  });
+});