@galadrim/galadmin 0.2.11 → 0.3.0-alpha.2.1

package/src/api/routes/subrecordsImport.ts

@@ -0,0 +1,114 @@
+import type { RequestHandler } from "../request";
+import type DbManager from "../../utils/dbManager";
+import * as multiparty from "multiparty";
+import { quoteIdentifier } from "../../utils/dbManager";
+import { canWriteView, roleOf } from "../authorization";
+import { formatValueForInsertion } from "../values";
+import { isImportRecords } from "../importRecords";
+
+export default (db: DbManager): RequestHandler =>
+  async function (req, res) {
+    const form = new multiparty.Form();
+    form.parse(req, async function (err, fields, files) {
+      if (err) {
+        return res.status(500).send(err);
+      }
+      // Get viewIndex and panelIndex in fields
+      const view = req.config!.views[fields.viewIndex![0] as `${number}`];
+      const panel = view
+        ? view.recordViewPanels![fields.panelIndex![0] as `${number}`]
+        : undefined;
+      // SECURITY: same write-guard as /recordsImport, plus the panel's own
+      // roles when it declares any.
+      if (
+        !view ||
+        !canWriteView(view, roleOf(req)) ||
+        !panel ||
+        !canWriteView(panel, roleOf(req))
+      ) {
+        return res.sendStatus(403);
+      }
+      if (typeof panel.parseImportFile !== "function") {
+        return res
+          .status(500)
+          .send(
+            '"parseImportFile" doit être défini dans la configuration du panneau.',
+          );
+      }
+      if (!Boolean(panel.createConfig)) {
+        return res
+          .status(500)
+          .send(
+            '"createConfig" doit être défini dans la configuration du panneau.',
+          );
+      }
+
+      const records: unknown = await panel.parseImportFile(
+        files.data![0],
+        fields.recordId![0],
+      );
+      /*
+      #PORTING-EDIT
+      The approved object-row shape check rejects invalid parser output before SQL insertion.
+      */
+      if (!isImportRecords(records)) {
+        return res.sendStatus(400);
+      }
+      const columns: string[] = [];
+      if (records.length === 0) {
+        return res.send({
+          affectedRows: 0,
+        });
+      }
+
+      try {
+        for (let record of records) {
+          for (let key in record) {
+            if (!columns.includes(key)) {
+              columns.push(key);
+            }
+          }
+        }
+
+        let queryString =
+          "INSERT IGNORE INTO ?? (" +
+          quoteIdentifier(panel.createConfig!.recordIdKey, db.dbType!) +
+          ", " +
+          columns.map((x) => quoteIdentifier(x, db.dbType!)).join(", ") +
+          ") VALUES";
+        for (let record of records) {
+          queryString +=
+            " (" +
+            fields.recordId![0] +
+            ", " +
+            columns
+              .map((x) => formatValueForInsertion(record[x], db.dbType!))
+              .join(", ") +
+            "),";
+        }
+        queryString = queryString.slice(0, -1) + " ON DUPLICATE KEY UPDATE";
+        for (let column of columns) {
+          queryString += ` ${quoteIdentifier(column, db.dbType!)} = VALUES(${quoteIdentifier(column, db.dbType!)}),`;
+        }
+        const { err, rows: r } = await db.query(queryString.slice(0, -1), [
+          panel.tableName,
+        ]);
+        if (err) {
+          console.error(err);
+          return res.status(500).send({
+            err,
+            message: "Une erreur est survenue.",
+          });
+        }
+        res.send({
+          affectedRows: (r as { affectedRows?: number }).affectedRows,
+        });
+      } catch (err) {
+        console.error(err);
+        res.status(500).send({
+          err,
+          message: "Une erreur est survenue.",
+        });
+      }
+    });
+  };

package/src/api/routes/updateRecord.ts

@@ -0,0 +1,74 @@
+import type { RequestHandler } from "../request";
+import type DbManager from "../../utils/dbManager";
+import type { DatabaseRow } from "../../utils/dbManager";
+import axios from "axios";
+import { quoteIdentifier } from "../../utils/dbManager";
+import { areSafeColumnNames, touchesHiddenColumn } from "../authorization";
+
+type RequestBody = {
+  viewIndex: string | number;
+  primaryValue: DatabaseRow[string];
+  data: Partial<DatabaseRow>;
+  previousData?: unknown;
+};
+
+export default (db: DbManager): RequestHandler<
+  Record<string, string>,
+  string | Error | { error: string },
+  RequestBody
+> =>
+  async function (req, res, next) {
+    const view = req.config!.views[req.body.viewIndex as number];
+    if (!areSafeColumnNames(req.body.data)) {
+      return res.status(400).send({ error: "Invalid column name" });
+    }
+    if (touchesHiddenColumn(view, req.body.data)) {
+      return res.sendStatus(403);
+    }
+    for (let key in req.body.data) {
+      if (
+        req.body.data[key] == "NULL" ||
+        req.body.data[key] === "" ||
+        req.body.data[key] === "Invalid date"
+      ) {
+        req.body.data[key] = null;
+      }
+    }
+    if (Object.keys(req.body.data).length === 0) {
+      return res.sendStatus(200);
+    }
+    const queryExpression = Object.keys(req.body.data)
+      .map((x) => `${quoteIdentifier(x, db.dbType!)} = ?`)
+      .join(", ");
+    const queryParameters = Object.keys(req.body.data).map(
+      (x) => req.body.data[x],
+    );
+    const { err } = await db.query(
+      `UPDATE ?? SET ${queryExpression} WHERE ?? = ?`,
+      [
+        view.tableName,
+        ...queryParameters,
+        view.primaryId,
+        req.body.primaryValue,
+      ],
+    );
+    if (err) {
+      return res.status(500).send(err);
+    }
+    if (view.editCallback) {
+      try {
+        await axios.post(view.editCallback, {
+          id: req.body.primaryValue,
+          data: req.body.data,
+          previousData: req.body.previousData,
+        });
+      } catch (e) {}
+    }
+    if (view.editCallbackFunction) {
+      await view.editCallbackFunction({
+        id: req.body.primaryValue as number, // TODO https://github.com/galadrimteam/galadmin/issues/45: route parameters and UUID keys are also strings.
+        data: req.body.data,
+      });
+    }
+    res.sendStatus(200);
+  };

package/src/api/routes/uploadFile.ts

@@ -0,0 +1,16 @@
+import type { FileUploadProperties } from "../../types/config";
+import type { RequestHandler } from "../request";
+import { uploadFile } from "../uploadFile";
+
+export default (): RequestHandler =>
+  async function (req, res, next) {
+    const view = req.config!.views[req.query.viewIndex as `${number}`];
+    const column = [
+      ...view.columns!,
+      ...(view.recordViewPanels
+        ?.map((x) => x?.createConfig?.columns)
+        ?.filter((x) => x)
+        ?.flat() || []),
+    ].find((x) => x!.__id__ == req.query.columnId);
+    uploadFile(column as FileUploadProperties, "file", req, res);
+  };

package/src/api/routes/uploadFileFromBetterRichTextInput.ts

@@ -0,0 +1,41 @@
+import type { RequestHandler } from "../request";
+import type { BetterRichTextColumn } from "../../types/config";
+import { uploadFile } from "../uploadFile";
+import { canWriteView, roleOf } from "../authorization";
+
+export default (): RequestHandler =>
+  async function (req, res, next) {
+    // Resolve settings on the server so function-valued pathTransform survives.
+    // Validate the target before parsing multipart data or contacting storage.
+    const role = roleOf(req);
+    const { viewIndex, columnId } = req.query;
+    if (
+      typeof viewIndex !== "string" ||
+      !/^\d+$/.test(viewIndex) ||
+      typeof columnId !== "string"
+    ) {
+      return res.sendStatus(403);
+    }
+    const view = req.config!.views[viewIndex as `${number}`];
+    if (!view || !canWriteView(view, role)) {
+      return res.sendStatus(403);
+    }
+    const column = [
+      ...(view.columns || []),
+      ...(view.recordViewPanels?.flatMap(
+        (panel) => panel.createConfig?.columns || [],
+      ) || []),
+    ].find((column) => column.__id__ === columnId);
+    if (
+      !column ||
+      (column.roles &&
+        !(column.roles as readonly (string | undefined)[]).includes(role))
+    ) {
+      return res.sendStatus(403);
+    }
+    const uploadColumn = column as typeof column & Pick<BetterRichTextColumn, "fileUploadProperties">;
+    if (column.dataType !== "betterRichText" || !uploadColumn.fileUploadProperties) {
+      return res.status(400).send({ error: "Invalid rich-text upload column" });
+    }
+    uploadFile(uploadColumn.fileUploadProperties, "upload", req, res);
+  };

package/src/api/uploadFile.ts

@@ -0,0 +1,249 @@
+import * as multiparty from "multiparty";
+import * as fs from "fs";
+import * as mime from "mime";
+import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { Storage } from "@google-cloud/storage";
+import { getImageDimensions } from "../utils/imageDimensions";
+import * as SftpClient from "ssh2-sftp-client";
+import axios from "axios";
+import type { IncomingMessage } from "http";
+import type { Response } from "express";
+import type { FileUploadProperties } from "../types/config";
+
+function firstUploadedFile(
+  files: Record<string, multiparty.File[] | undefined>,
+  field: string,
+  res: Response,
+) {
+  const file = files[field]?.[0];
+  /*
+  #PORTING-EDIT
+  Reject a missing upload field with HTTP 400 before reading file metadata.
+  The multipart parser permits requests without the requested file.
+  */
+  if (!file) res.status(400).send("Missing upload file");
+  return file;
+}
+
+function sftpProperty(
+  config: FileUploadProperties["sftpConfig"],
+  key: keyof NonNullable<FileUploadProperties["sftpConfig"]>,
+) {
+  if (config === undefined) {
+    throw new TypeError(`Cannot read properties of undefined (reading '${key}')`);
+  }
+  return config[key];
+}
+
+export function uploadFile(
+  column: FileUploadProperties,
+  fileParamName: string,
+  req: IncomingMessage,
+  res: Response,
+) {
+    if (column.s3Config || column.gcpConfig) {
+      const form = new multiparty.Form();
+      form.parse(req, async function (err, fields, files) {
+        if (err) {
+          return res.status(500).send(err);
+        }
+        const file = firstUploadedFile(files, fileParamName, res);
+        if (!file) return;
+        const originalFilename = file.originalFilename;
+        const contentType =
+          mime.getType(originalFilename) || "application/octet-stream";
+
+        const extension = originalFilename.match(/(?:\.([^.]+))?$/)?.[1];
+        let aspectRatio: number | null = null;
+        if (extension !== undefined && ["png", "jpeg", "jpg", "gif"].includes(extension)) {
+          try {
+            const dimensions = await getImageDimensions(
+              file.path,
+            );
+            if (dimensions) {
+              aspectRatio = dimensions.height / dimensions.width;
+            }
+          } catch {
+            // malformed image data: leave aspectRatio null rather than crash
+          }
+        }
+        const originalFilenameWithoutExtension = originalFilename.replace(
+          "." + extension,
+          "",
+        );
+
+        if (column.gcpConfig) {
+          const gcpConfig = column.gcpConfig;
+          const path =
+            (gcpConfig.subfolder ? gcpConfig.subfolder + "/" : "") +
+            originalFilenameWithoutExtension +
+            "-" +
+            Math.random().toString().substr(2) +
+            "." +
+            extension;
+          const storage = new Storage();
+
+          const bucketName = gcpConfig.bucket;
+          storage
+            .bucket(bucketName)
+            .upload(file.path, {
+              destination: path,
+            })
+            .then(() => {
+              res.status(200).send({
+                path: gcpConfig.pathTransform
+                  ? gcpConfig.pathTransform(path)
+                  : path,
+                aspectRatio,
+                originalFilename,
+              });
+            })
+            .catch((e: unknown) => {
+              res.status(500).send(e);
+            });
+        } else {
+          const s3Config = column.s3Config;
+          if (!s3Config) {
+            throw new TypeError("Cannot read properties of undefined (reading 'subfolder')");
+          }
+          const path =
+            (s3Config.subfolder ? s3Config.subfolder + "/" : "") +
+            originalFilenameWithoutExtension +
+            "-" +
+            Math.random().toString().substr(2) +
+            "." +
+            extension;
+          const rawHost = String(s3Config.host || "");
+          const endpoint = /^https?:\/\//i.test(rawHost)
+            ? rawHost
+            : `https://${rawHost}`;
+          const s3 = new S3Client({
+            endpoint,
+            region: s3Config.region,
+            ...(s3Config.accessKeyId && {
+              credentials: {
+                accessKeyId: s3Config.accessKeyId,
+                secretAccessKey: s3Config.secretAccessKey ?? "",
+              },
+            }),
+            forcePathStyle: false,
+          });
+          if (s3Config.signedUrlNeeded) {
+            getSignedUrl(
+              s3,
+              new PutObjectCommand({
+                Bucket: s3Config.bucket,
+                Key: path,
+                ContentType: contentType,
+              }),
+              { expiresIn: 150 },
+            )
+              .then((signedUrl) =>
+                axios.put(
+                  signedUrl,
+                  fs.readFileSync(file.path),
+                  {
+                    maxContentLength: 100000000000,
+                    maxBodyLength: 100000000000,
+                    headers: {
+                      "Content-Type": contentType,
+                    },
+                  },
+                ),
+              )
+              .then(() => {
+                res.status(200).send({
+                  path: s3Config.pathTransform
+                    ? s3Config.pathTransform(path)
+                    : path,
+                  aspectRatio,
+                  originalFilename,
+                });
+              })
+              .catch((e: unknown) => {
+                res.status(500).send(e);
+              });
+          } else {
+            s3.send(
+              new PutObjectCommand({
+                Body: fs.readFileSync(file.path),
+                Bucket: s3Config.bucket,
+                ContentType: contentType,
+                ACL: "public-read",
+                Key: path,
+              }),
+            )
+              .then(() => {
+                res.send({
+                  url: `https://${s3Config.host}/${s3Config.bucket}/${path}`,
+                  path: s3Config.pathTransform
+                    ? s3Config.pathTransform(path)
+                    : path,
+                  aspectRatio,
+                  originalFilename,
+                });
+              })
+              .catch((err: unknown) => res.status(500).send(err));
+          }
+        }
+      });
+    } else if (column.sftpConfig) {
+      if (!column.publicPath) {
+        return res
+          .status(500)
+          .send("You need to pass publicPath parameter when using sftpConfig");
+      }
+      const form = new multiparty.Form();
+      form.parse(req, function (err, fields, files) {
+        if (err) {
+          return res.status(500).send(err);
+        }
+        const file = firstUploadedFile(files, fileParamName, res);
+        if (!file) return;
+        const pathSplitted = file.path.split(/[\/\\]+/);
+        const filename = pathSplitted[pathSplitted.length - 1];
+        (async () => {
+          const sftp = new SftpClient();
+          await sftp.connect({
+            host: sftpProperty(column.sftpConfig, "host"),
+            port: 22,
+            username: sftpProperty(column.sftpConfig, "user"),
+            password: sftpProperty(column.sftpConfig, "password"),
+          });
+          await sftp.fastPut(
+            file.path,
+            column.publicPath +
+              (column.subdirectory ? "/" + column.subdirectory : "") +
+              "/" +
+              filename,
+          );
+          await sftp.end();
+          res.send({
+            path: filename,
+            originalFilename: file.originalFilename,
+          });
+          fs.unlinkSync(file.path);
+        })();
+      });
+    } else {
+      const publicPath = column.publicPath;
+      const subdirectory = column.subdirectory;
+      const form = new multiparty.Form({
+        uploadDir: publicPath === undefined && subdirectory === undefined
+          ? undefined
+          : String(publicPath) + String(subdirectory),
+      });
+      form.parse(req, function (err, fields, files) {
+        if (err) {
+          return res.status(500).send(err);
+        }
+        const file = firstUploadedFile(files, fileParamName, res);
+        if (!file) return;
+        res.send({
+          path: file.path.replace(String(column.publicPath), ""),
+          originalFilename: file.originalFilename,
+        });
+      });
+    }
+  }

package/src/api/values.ts

@@ -0,0 +1,96 @@
+import type {
+  BaseTypeColumn,
+  SelectColumn,
+  StandardColumn,
+} from "../types/config";
+
+type FormattingColumn = Pick<
+  BaseTypeColumn,
+  "formatValueForExport" | "formattedValue" | "formatValue"
+> & StandardColumn & Partial<Pick<SelectColumn, "options">>;
+
+export async function getFormattedValue(
+  column: FormattingColumn,
+  record: Record<string, unknown>,
+): Promise<unknown> {
+  let value: unknown;
+  try {
+    record.options = column.options;
+    if (column.formatValueForExport) {
+      value = await column.formatValueForExport(record);
+    } else if (column.formattedValue) {
+      value = evalExpression(column.formattedValue, record);
+    } else if (column.formatValue) {
+      value = await column.formatValue(record);
+    } else if (column.dataType == "tinyint") {
+      value = record[String(column.name)] == 1 ? "Oui" : "Non";
+    } else {
+      value = record[String(column.name)];
+    }
+    return value === null || typeof value == "undefined" ? "" : value;
+  } catch (err) {
+    return value || "";
+  }
+}
+
+export function evalExpression(
+  expression: string,
+  data: Record<string, unknown>,
+): unknown {
+  let varString = "";
+  let statement = "";
+
+  try {
+    for (let key in data) {
+      statement =
+        "var " +
+        key +
+        " = " +
+        (typeof data[key] === "string"
+          ? "'" +
+            data[key]
+              .replace(/'/g, "\\'")
+              .replace(/\n/g, "")
+              .replace(/\r/g, "") +
+            "'"
+          : typeof data[key] === "object"
+            ? JSON.stringify(data[key])
+            : data[key]) +
+        ";";
+      varString += statement;
+    }
+    const result: unknown = eval(varString + expression);
+    return result;
+  } catch (e) {
+    console.log("Problème d'évaluation de l'expression", statement);
+    console.error(e);
+    return "Error";
+  }
+}
+
+export function formatValueForInsertion(value: unknown, dbType: string) {
+  if (value !== 0 && !value) {
+    return "NULL";
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (typeof value === "string") {
+    if (dbType === "POSTGRESQL") {
+      return "'" + value.replace(/'/g, "''") + "'";
+    } else {
+      return "'" + value.replace(/'/g, "\\'") + "'";
+    }
+  }
+  if (typeof value === "object") {
+    return "'" + JSON.stringify(value).replace(/'/g, "\\'") + "'";
+  }
+  if (typeof value === "boolean") {
+    return value ? "TRUE" : "FALSE";
+  }
+  if (typeof value === "number") {
+    return value;
+  }
+
+  return value;
+}