@galadrim/galadmin 0.2.11 → 0.3.0-alpha.2.1

package/src/api/routes/deleteRecords.ts

@@ -0,0 +1,28 @@
+import type { RequestHandler } from "../request";
+import type DbManager from "../../utils/dbManager";
+import type { DatabaseRow } from "../../utils/dbManager";
+
+type RequestBody = {
+  viewIndex: string | number;
+  primaryValues: DatabaseRow[string][];
+};
+
+export default (db: DbManager): RequestHandler<
+  Record<string, string>,
+  string | Error,
+  RequestBody
+> =>
+  async function (req, res, next) {
+    const view = req.config!.views[req.body.viewIndex as number];
+    // SECURITY: bind the primary values as parameters instead of interpolating
+    // them into the IN() list (quote-bearing values could break out).
+    const placeholders = req.body.primaryValues.map(() => "?").join(", ");
+    const { err } = await db.query(
+      `DELETE FROM ?? WHERE ?? IN(${placeholders})`,
+      [view.tableName, view.primaryId, ...req.body.primaryValues],
+    );
+    if (err) {
+      return res.status(500).send(err);
+    }
+    res.sendStatus(200);
+  };

package/src/api/routes/duplicateRecord.ts

@@ -0,0 +1,73 @@
+import type { RequestHandler } from "../request";
+import { writableTables } from "../authorization";
+import type DbManager from "../../utils/dbManager";
+import type { DatabaseRow } from "../../utils/dbManager";
+
+type RequestBody = {
+  table: string;
+  primaryValue: DatabaseRow[string];
+  duplicateConfig: {
+    primaryId: string;
+    fields: string[];
+    foreignTables: { table: string; fields: string[] }[];
+  };
+};
+
+export default (db: DbManager): RequestHandler<
+  Record<string, string>,
+  string | Error | null,
+  RequestBody
+> =>
+  async function (req, res, next) {
+    // SECURITY: bound the (client-supplied) target table to tables the role may write.
+    const allowedTables = writableTables(req);
+    const requestedTables = [
+      req.body.table,
+      ...(req.body.duplicateConfig?.foreignTables || []).map((t) => t.table),
+    ];
+    if (requestedTables.some((t) => !allowedTables.has(t))) {
+      return res.sendStatus(403);
+    }
+    const primaryId = req.body.duplicateConfig.primaryId;
+    const { err, rows } = await db.query("SELECT * FROM ?? WHERE ?? = ?", [
+      req.body.table,
+      primaryId,
+      req.body.primaryValue,
+    ]);
+    if (err) {
+      return res.status(500).send(err);
+    }
+    const record = (rows as Partial<DatabaseRow>[])[0];
+    const data: Partial<DatabaseRow> = {};
+    for (let field of req.body.duplicateConfig.fields) {
+      data[field] = record[field];
+    }
+    const { err: err2, rows: r } = await db.query(
+      "INSERT IGNORE INTO ?? SET ?",
+      [req.body.table, data],
+    );
+    if (err2) {
+      return res.status(500).send(err);
+    }
+    const newRecordId = (r as { insertId?: number }).insertId;
+    for (let foreignTable of req.body.duplicateConfig.foreignTables) {
+      const { err, rows } = await db.query("SELECT * FROM ?? WHERE ?? = ?", [
+        foreignTable.table,
+        primaryId,
+        req.body.primaryValue,
+      ]);
+      if (err) console.log(err);
+      for (let record of rows as Partial<DatabaseRow>[]) {
+        const data: Partial<DatabaseRow> = {};
+        data[primaryId] = newRecordId;
+        for (let field of foreignTable.fields) {
+          data[field] = record[field];
+        }
+        await db.query("INSERT IGNORE INTO ?? SET ?", [
+          foreignTable.table,
+          data,
+        ]);
+      }
+    }
+    res.sendStatus(200);
+  };

package/src/api/routes/foreignSelectRecords.ts

@@ -0,0 +1,80 @@
+import type { RequestHandler } from "../request";
+import { evalExpression } from "../values";
+import { sqlAnd } from "../queries";
+import type createRecordQueries from "../queries";
+import type DbManager from "../../utils/dbManager";
+import { filterUserFromSession } from "../filterUser";
+
+type ForeignSelectRecordsRequestBody = {
+  viewIndex: string | number;
+  columnId: string;
+  query?: string;
+};
+
+export default (db: DbManager, getRecords: ReturnType<typeof createRecordQueries>["getRecords"]): RequestHandler<Record<string, string>, object, ForeignSelectRecordsRequestBody> =>
+  async (req, res, next) => {
+    const view = req.config!.views[req.body.viewIndex as number];
+    const column = [
+      ...view.columns!,
+      ...(view.recordViewPanels
+        ?.map((x) => x?.createConfig?.columns)
+        ?.filter((x) => x)
+        ?.flat() || []),
+    ].find((x) => x!.__id__ === req.body.columnId)!;
+    const queryEscaped =
+      db.dbType === "POSTGRESQL"
+        ? req.body.query?.replace(/'/g, "''")
+        : req.body.query?.replace(/'/g, "\\'");
+    const queryStart = {
+      table: column.table!,
+      page: 1,
+    };
+    const filters: Parameters<typeof sqlAnd>[0] = [
+      column.filters,
+      req.body.query
+        ? `${column.searchableName} LIKE '${column.wholeSearch ? "%" : ""}${queryEscaped}%'`
+        : null,
+    ];
+    /*
+    #PORTING-EDIT
+    Pass a checked FilterUser to the configured callback and return 401 before querying when its session identity is invalid.
+    */
+    if (column.filtersFromUser) {
+      const user = filterUserFromSession(req.session?.user);
+      if (user === undefined) return res.sendStatus(401);
+      filters.push(column.filtersFromUser(user));
+    } else {
+      filters.push(null);
+    }
+    const { rows: records, error } = await getRecords({
+      ...queryStart,
+      filters: sqlAnd(filters),
+      join: column.join,
+      selectExpression: column.selectExpression,
+      orderBy: column.orderBy,
+      limit: column.limit || 1000,
+    });
+    if (error) {
+      return res.status(500).send(error);
+    }
+    const options = await Promise.all(
+      records.map(async (record) => {
+        let label;
+        if (column.formatForeignValue) {
+          label = await column.formatForeignValue(record);
+        } else if (column.formatValue) {
+          label = await column.formatValue(record);
+        } else if (column.formattedValue) {
+          label = evalExpression(column.formattedValue, record);
+        } else {
+          label = record[column.name!];
+        }
+        const value = record[column.foreignName!] || record[column.name!];
+        return {
+          value,
+          label,
+        };
+      }),
+    );
+    res.send(options);
+  };

package/src/api/routes/notificationBadges.ts

@@ -0,0 +1,47 @@
+import type { RequestHandler } from "../request";
+import type DbManager from "../../utils/dbManager";
+import type { DatabaseRow } from "../../utils/dbManager";
+import type { BaseTypeView } from "../../types/config";
+
+type BadgeTarget = Pick<BaseTypeView, "notificationBadge"> & { __id__?: string };
+type BadgeRows = { length?: number; [index: number]: Partial<DatabaseRow> };
+type NotificationBadges = Record<string, DatabaseRow[string] | undefined>;
+
+export default (db: DbManager): RequestHandler<
+  Record<string, string>,
+  NotificationBadges
+> =>
+  async function (req, res) {
+    const notificationBadges: NotificationBadges = {};
+
+    async function checkAndGetNotificationBadge(obj: BadgeTarget) {
+      if (obj.notificationBadge) {
+        const { err, rows } = await db.query(obj.notificationBadge.query);
+        if (err) {
+          console.error(err);
+        } else if (
+          ((rows as BadgeRows).length as number) > 0 &&
+          (rows as BadgeRows)[0][obj.notificationBadge.attribute]
+        ) {
+          const notificationBadge =
+            (rows as BadgeRows)[0][obj.notificationBadge.attribute];
+          if (
+            !obj.notificationBadge.displayCondition ||
+            obj.notificationBadge.displayCondition(notificationBadge)
+          ) {
+            notificationBadges[obj.__id__ as string] = notificationBadge;
+          }
+        }
+      }
+    }
+
+    for (const view of req.config!.views) {
+      await checkAndGetNotificationBadge(view);
+      if (view.subviews) {
+        for (const subview of view.subviews) {
+          await checkAndGetNotificationBadge(subview);
+        }
+      }
+    }
+    res.send(notificationBadges);
+  };

package/src/api/routes/record.ts

@@ -0,0 +1,48 @@
+import { stripHiddenColumns } from "../authorization";
+import type { RequestHandler } from "../request";
+import type DbManager from "../../utils/dbManager";
+import type { DatabaseRow } from "../../utils/dbManager";
+
+type QueryRows = NonNullable<Awaited<ReturnType<DbManager["query"]>>["rows"]>;
+type QueryElement = Extract<QueryRows, object[]>[number];
+type IndexedRows = {
+  length?: number;
+  [index: number]: QueryElement | undefined;
+};
+type ResponseBody = QueryElement | undefined | string | Error;
+
+export default (db: DbManager): RequestHandler<
+  Record<string, string>,
+  ResponseBody
+> =>
+  async function (req, res) {
+    const view = req.config!.views[req.query.viewIndex as `${number}`];
+    const { err, rows } = await db.query(
+      "SELECT " +
+        (view.selectExpression || "*") +
+        " FROM ?? " +
+        (view.join || "") +
+        " WHERE ?? = ?",
+      [
+        view.tableName,
+        view.tableName + "." + view.primaryId,
+        req.query.recordId,
+      ],
+    );
+    if (err) {
+      return res.status(500).send(err);
+    }
+    if (((rows as IndexedRows).length as number) > 0) {
+      const record = (rows as IndexedRows)[0];
+      for (const column of view.columns!) {
+        if (column.formatValue) {
+          (record as DatabaseRow)[`__formatValue-${column.__id__}__`] =
+            await column.formatValue(record);
+        }
+      }
+      // @ts-expect-error TODO: remove this annotation in the related porting pass
+      res.send(stripHiddenColumns(view, record));
+    } else {
+      res.sendStatus(404);
+    }
+  };

package/src/api/routes/records.ts

@@ -0,0 +1,91 @@
+import { stripHiddenColumns } from "../authorization";
+import type { RequestHandler } from "../request";
+import { sqlAnd } from "../queries";
+import type createRecordQueries from "../queries";
+import { filterUserFromSession } from "../filterUser";
+
+type RecordsRequestBody = {
+  viewIndex: string | number;
+  subviewIndex?: string | number;
+  isDesc?: boolean | null;
+  orderBy?: string;
+  page: string | number;
+  query?: string;
+  filters: Parameters<typeof sqlAnd>[0];
+};
+
+export default (getRecords: ReturnType<typeof createRecordQueries>["getRecords"]): RequestHandler<Record<string, string>, object, RecordsRequestBody> =>
+  async function (req, res, next) {
+    const view = req.config!.views[req.body.viewIndex as number];
+    const isDesc = req.body.isDesc === null ? view.isDesc : req.body.isDesc;
+    const subview =
+      view.subviews && req.body.subviewIndex !== undefined
+        ? view.subviews[req.body.subviewIndex as number]
+        : null;
+    const orderBy = req.body.orderBy || subview?.orderBy || view.orderBy;
+    const queryStart = {
+      table: view.tableName!,
+      page: req.body.page,
+    };
+    const filters: Parameters<typeof sqlAnd>[0] = [
+      view.filters,
+      subview?.filters,
+      ...req.body.filters,
+    ];
+    /*
+    #PORTING-EDIT
+    Pass a checked FilterUser to the configured callback and return 401 before querying when its session identity is invalid.
+    */
+    if (view.filtersFromUser) {
+      const user = filterUserFromSession(req.session?.user);
+      if (user === undefined) return res.sendStatus(401);
+      filters.push(view.filtersFromUser(user));
+    } else {
+      filters.push(null);
+    }
+    const {
+      rows: records,
+      input,
+      error,
+      count,
+    } = await getRecords(
+      {
+        ...queryStart,
+        filters: sqlAnd(filters),
+        having: subview?.having,
+        customQuery: view.customQuery,
+        join: view.join,
+        selectExpression: view.selectExpression,
+        orderBy: [
+          orderBy ? `${orderBy} ${isDesc ? "DESC" : "ASC"}` : null,
+          view.primaryId,
+        ]
+          .filter((x) => x)
+          .join(", "),
+        primaryId: view.primaryId,
+        query: req.body.query,
+        groupBy: view.groupBy,
+        columns: view.columns,
+        limit: view.limit || 10,
+      },
+      true,
+    );
+    if (error) {
+      return res.status(500).send(error);
+    }
+
+    for (const column of view.columns!) {
+      if (column.formatValue) {
+        for (const record of records) {
+          record[`__formatValue-${column.__id__}__`] =
+            await column.formatValue(record);
+        }
+      }
+    }
+    for (const record of records) stripHiddenColumns(view, record);
+    res.send({
+      records,
+      input,
+      count,
+    });
+  };

package/src/api/routes/recordsExport.ts

@@ -0,0 +1,92 @@
+import type { RequestHandler } from "../request";
+import { getFormattedValue } from "../values";
+import { sqlAnd } from "../queries";
+import type createRecordQueries from "../queries";
+import { filterUserFromSession } from "../filterUser";
+
+type RecordsExportRequestBody = {
+  viewIndex: string | number;
+  subviewIndex?: string | number;
+  isDesc?: boolean | null;
+  orderBy?: string;
+  query?: string;
+  filters: Parameters<typeof sqlAnd>[0][number];
+};
+
+export default (getRecords: ReturnType<typeof createRecordQueries>["getRecords"]): RequestHandler<Record<string, string>, object, RecordsExportRequestBody> =>
+  async function (req, res) {
+    const view = req.config!.views[req.body.viewIndex as number];
+    const orderBy = req.body.orderBy || view.orderBy;
+    const isDesc = req.body.isDesc === null ? view.isDesc : req.body.isDesc;
+    const subview =
+      view.subviews && req.body.subviewIndex !== undefined
+        ? view.subviews[req.body.subviewIndex as number]
+        : null;
+    const queryStart = {
+      table: view.tableName!,
+      page: 1,
+      allRecords: true,
+    };
+    const filters: Parameters<typeof sqlAnd>[0] = [
+      view.filters,
+      subview?.filters,
+      req.body.filters,
+    ];
+    // SECURITY: scope the export exactly like the list view, otherwise a
+    // user could download rows their filtersFromUser clause hides.
+    /*
+    #PORTING-EDIT
+    Pass a checked FilterUser to the configured callback and return 401 before querying when its session identity is invalid.
+    */
+    if (view.filtersFromUser) {
+      const user = filterUserFromSession(req.session?.user);
+      if (user === undefined) return res.sendStatus(401);
+      filters.push(view.filtersFromUser(user));
+    } else {
+      filters.push(null);
+    }
+    const { rows: records, error } = await getRecords({
+      ...queryStart,
+      filters: sqlAnd(filters),
+      having: subview?.having,
+      customQuery: view.customQuery,
+      join: view.join,
+      selectExpression: view.selectExpression,
+      orderBy: orderBy ? `${orderBy} ${isDesc ? "DESC" : "ASC"}` : null,
+      primaryId: view.primaryId,
+      query: req.body.query,
+      groupBy: view.groupBy,
+      columns: view.columns!,
+      limit: view.limit || 10,
+    });
+    if (error) {
+      return res.status(500).send(error);
+    }
+    let output = "";
+    const columns = view.columns!;
+    for (let j = 0; j < columns.length; j++) {
+      if (!columns[j].hideInTable || columns[j].includeInExport) {
+        if (j > 0) output += ";";
+        output += columns[j].label;
+      }
+    }
+    for (let i in records) {
+      const el = records[i];
+      output += "\r\n";
+      for (let j = 0; j < columns.length; j++) {
+        if (!columns[j].hideInTable || columns[j].includeInExport) {
+          if (j > 0) output += ";";
+          if (columns[j].dataType == "textarea") {
+            output += '"';
+          }
+          output += await getFormattedValue(columns[j], el);
+          if (columns[j].dataType == "textarea") {
+            output += '"';
+          }
+        }
+      }
+    }
+    res.send({
+      content: output,
+    });
+  };

package/src/api/routes/recordsImport.ts

@@ -0,0 +1,115 @@
+import type { RequestHandler } from "../request";
+import type DbManager from "../../utils/dbManager";
+import * as multiparty from "multiparty";
+import { quoteIdentifier } from "../../utils/dbManager";
+import { canWriteView, roleOf, hiddenColumnsOf } from "../authorization";
+import { formatValueForInsertion } from "../values";
+import { isImportRecords } from "../importRecords";
+
+export default (db: DbManager): RequestHandler =>
+  async function (req, res) {
+    const form = new multiparty.Form();
+    form.parse(req, async function (err, fields, files) {
+      if (err) {
+        return res.status(500).send(err);
+      }
+      // Get viewIndex in fields
+      const view = req.config!.views[fields.viewIndex![0] as `${number}`];
+      // SECURITY: the generic write-guard cannot see a viewIndex buried in a
+      // multipart body, so imports enforce the view's write roles here.
+      if (!view || !canWriteView(view, roleOf(req))) {
+        return res.sendStatus(403);
+      }
+      if (typeof view.parseImportFile !== "function") {
+        return res
+          .status(500)
+          .send(
+            '"parseImportFile" doit être défini dans la configuration de la vue.',
+          );
+      }
+
+      const records: unknown = await view.parseImportFile(files.data![0]);
+      /*
+      #PORTING-EDIT
+      The approved import shape check rejects non-object parser output before SQL insertion.
+      */
+      if (!isImportRecords(records)) {
+        return res.sendStatus(400);
+      }
+      const columns: string[] = [];
+      if (records.length === 0) {
+        return res.send({
+          affectedRows: 0,
+        });
+      }
+
+      try {
+        for (let record of records) {
+          for (let key in record) {
+            if (!columns.includes(key)) {
+              columns.push(key);
+            }
+          }
+        }
+
+        if (columns.some((name) => hiddenColumnsOf(view).includes(name))) {
+          return res.sendStatus(403);
+        }
+
+        let queryString;
+        if (db.dbType === "POSTGRESQL") {
+          queryString = `INSERT INTO ?? (${columns.map((x) => quoteIdentifier(x, db.dbType!)).join(", ")}) VALUES`;
+
+          for (let record of records) {
+            const valuesList = columns
+              .map((x) => formatValueForInsertion(record[x], db.dbType!))
+              .join(", ");
+            queryString += ` (${valuesList}),`;
+          }
+          queryString =
+            queryString.slice(0, -1) +
+            ` ON CONFLICT (${view.importFileUniqueField}) DO UPDATE SET `;
+
+          for (let column of columns) {
+            queryString += `${quoteIdentifier(column, db.dbType!)} = EXCLUDED.${quoteIdentifier(column, db.dbType!)},`;
+          }
+        } else {
+          queryString =
+            "INSERT INTO ?? (" +
+            columns.map((x) => quoteIdentifier(x, db.dbType!)).join(", ") +
+            ") VALUES";
+          for (let record of records) {
+            queryString +=
+              " (" +
+              columns
+                .map((x) => formatValueForInsertion(record[x], db.dbType!))
+                .join(", ") +
+              "),";
+          }
+          queryString = queryString.slice(0, -1) + " ON DUPLICATE KEY UPDATE";
+          for (let column of columns) {
+            queryString += ` ${quoteIdentifier(column, db.dbType!)} = VALUES(${quoteIdentifier(column, db.dbType!)}),`;
+          }
+        }
+        queryString = queryString.slice(0, -1); // Remove the trailing comma
+
+        const { err, rows: r } = await db.query(queryString, [view.tableName]);
+        if (err) {
+          console.error(err);
+          return res.status(500).send({
+            err,
+            message: "Une erreur est survenue.",
+          });
+        }
+        res.send({
+          affectedRows: (r as { affectedRows?: number }).affectedRows,
+        });
+      } catch (err) {
+        console.error(err);
+        res.status(500).send({
+          err,
+          message: "Une erreur est survenue.",
+        });
+      }
+    });
+  };

package/src/api/routes/searchCompanies.ts

@@ -0,0 +1,96 @@
+import type { RequestHandler } from "../request";
+import axios from "axios";
+
+type JsonValue = string | number | boolean | null | JsonValue[] | JsonObject;
+type JsonObject = { [key: string]: JsonValue | undefined };
+type CompanySuggestion = {
+  id: string;
+  companyName: JsonValue | undefined;
+  siret: JsonValue | undefined;
+  siren: JsonValue | undefined;
+  address: string;
+  city: JsonValue | undefined;
+  zipCode: JsonValue | undefined;
+  activityNumber: JsonValue | undefined;
+};
+type SearchQuery = string & {
+  replaceAll(search: string, replacement: string): string;
+};
+
+function isJsonValue(value: unknown): value is JsonValue {
+  const pending: unknown[] = [value];
+  while (pending.length > 0) {
+    const candidate = pending.pop();
+    if (
+      candidate === null ||
+      typeof candidate === "string" ||
+      typeof candidate === "number" ||
+      typeof candidate === "boolean"
+    ) {
+      continue;
+    }
+    if (typeof candidate !== "object") return false;
+    const children: unknown[] = Array.isArray(candidate)
+      ? candidate
+      : Object.values(candidate);
+    for (const child of children) pending.push(child);
+  }
+  return true;
+}
+
+function readEstablishments(data: unknown): JsonValue[] {
+  if (
+    typeof data !== "object" ||
+    data === null ||
+    !("results" in data) ||
+    !Array.isArray(data.results)
+  ) {
+    throw new TypeError("Invalid establishment results");
+  }
+  const results: unknown[] = data.results;
+  if (!results.every(isJsonValue)) {
+    throw new TypeError("Invalid establishment JSON");
+  }
+  return results;
+}
+
+function isActiveEstablishment(value: JsonValue): value is JsonObject {
+  if (value === null) throw new TypeError("Cannot read properties of null");
+  return (
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    value.etatadministratifetablissement === "Actif"
+  );
+}
+
+export default (): RequestHandler<Record<string, string>, CompanySuggestion[]> =>
+  async (req, res) => {
+    const processedQuery = (req.query.query as SearchQuery).replaceAll(" ", "-");
+    try {
+      const response = await axios.get<unknown>(
+        `https://public.opendatasoft.com/api/explore/v2.1/catalog/datasets/economicref-france-sirene-v3/records`,
+        {
+          params: {
+            where: `denominationunitelegale LIKE '${processedQuery}*' OR siret LIKE '${processedQuery}*'`,
+            limit: 100,
+          },
+        },
+      );
+      const results = readEstablishments(response.data)
+        .filter(isActiveEstablishment)
+        .map((etablissement) => ({
+          id: Math.random().toString().slice(2),
+          companyName: etablissement.denominationunitelegale,
+          siret: etablissement.siret,
+          siren: etablissement.siren,
+          address: `${etablissement.numerovoieetablissement || ""} ${etablissement.typevoieetablissement || ""} ${etablissement.libellevoieetablissement || ""}`,
+          city: etablissement.libellecommuneetablissement,
+          zipCode: etablissement.codepostaletablissement,
+          activityNumber: etablissement.activiteprincipaleunitelegale,
+        }))
+        .slice(0, 30);
+      res.send(results);
+    } catch (e) {
+      res.send([]);
+    }
+  };