@galadrim/galadmin 0.2.12 → 0.3.0-alpha.2.1

package/src/api/queries.ts

@@ -0,0 +1,194 @@
+import { quoteIdentifier } from "../utils/dbManager";
+import type dbManager from "../utils/dbManager";
+import type { DatabaseRow } from "../utils/dbManager";
+import type { BaseTypeColumn, Filter, StandardColumn } from "../types/config";
+
+type Condition = string | Filter[];
+type RecordQueryParams = {
+  table: string;
+  page: string | number;
+  limit: string | number;
+  allRecords?: boolean;
+  filters?: Condition | null;
+  query?: string;
+  columns?: (Pick<BaseTypeColumn, "searchable" | "searchableName"> & StandardColumn)[];
+  customQuery?: string;
+  selectExpression?: string;
+  join?: string;
+  groupBy?: string;
+  having?: string;
+  orderBy?: string | null;
+  primaryId?: string;
+};
+type RecordQueryResult = {
+  rows: DatabaseRow[];
+  queryString: string;
+  input: { query: string; params: RecordQueryParams };
+  count: NonNullable<DatabaseRow[string]> | undefined;
+  error?: never;
+} | {
+  error: Error;
+  rows?: never;
+  queryString?: never;
+  input?: never;
+  count?: never;
+};
+
+/*
+#PORTING-EDIT
+Reject absent rows, mutation headers, and nested result sets where record queries require row arrays.
+*/
+function readRecordRows(rows: Awaited<ReturnType<dbManager["query"]>>["rows"]): DatabaseRow[] {
+  if (!Array.isArray(rows) || !rows.every((row): row is DatabaseRow => !Array.isArray(row))) {
+    throw new TypeError("Invalid record query rows");
+  }
+  return rows;
+}
+
+export function sqlAnd(conditions: (Condition | null | undefined)[]) {
+  const existingConditions: Condition[] = [];
+  for (const condition of conditions) {
+    if (condition && condition.length > 0) {
+      existingConditions.push(condition);
+    }
+  }
+  if (existingConditions.length <= 1) {
+    return existingConditions[0] || null;
+  } else {
+    let result = "";
+    for (let i = 0; i < existingConditions.length; i++) {
+      if (i > 0) {
+        result += " AND ";
+      }
+      result += "(" + existingConditions[i] + ")";
+    }
+    return result;
+  }
+}
+
+// Collect every SQL template declared anywhere in the (role-filtered) config:
+// panel `query`, `autocompleteListQuery`, etc. customQuery may only run a
+// template that already exists in the config the caller is allowed to see —
+// so it can never be turned into an arbitrary read/write primitive.
+export function collectAllowedQueries(node: unknown, acc = new Set<string>()): Set<string> {
+  if (!node || typeof node !== "object") return acc;
+  if (Array.isArray(node)) {
+    for (const item of node) collectAllowedQueries(item, acc);
+    return acc;
+  }
+  for (const key of Object.keys(node)) {
+    const value: unknown = Reflect.get(node, key);
+    if (typeof value === "string" && (key === "query" || /Query$/.test(key))) {
+      acc.add(value.trim());
+    } else if (value && typeof value === "object") {
+      collectAllowedQueries(value, acc);
+    }
+  }
+  return acc;
+}
+
+export default (db: Pick<dbManager, "query" | "dbType">) => {
+  async function getRecords(params: RecordQueryParams, computeCount = false): Promise<RecordQueryResult> {
+    let queryString = "";
+    if (params.filters) {
+      queryString = " WHERE (" + params.filters + ")";
+    }
+    if (params.query) {
+      const columns = params.columns ?? [];
+      let isNewCondition = true;
+      for (let i in columns) {
+        if (
+          columns[i].searchable !== false &&
+          (columns[i].searchableName || columns[i].name)
+        ) {
+          if (queryString.length == 0) {
+            queryString += " WHERE (";
+          } else if (isNewCondition) {
+            queryString += " AND (";
+          } else {
+            queryString += " OR ";
+          }
+          if (columns[i].searchableName) {
+            // on ne doit pas ajouter de backticks sur le searchableName car celui-ci peut être une fonction
+            // exemple : searchableName = "CONCAT_WS(' ', firstname, lastname)"
+            queryString += columns[i].searchableName;
+          } else if (columns[i].name) {
+            queryString += columns[i].name
+              .split(".")
+              .map((x) => quoteIdentifier(x, db.dbType ?? ""))
+              .join(".");
+          }
+          // SECURITY: escape the user query per dialect — PostgreSQL does not
+          // treat backslashes as escapes inside standard strings, so a `\'`
+          // would terminate the literal early.
+          const searchEscaped =
+            db.dbType === "POSTGRESQL"
+              ? params.query.replace(/'/g, "''")
+              : params.query.replace(/'/g, "\\'");
+          queryString += " LIKE '%" + searchEscaped + "%'";
+          isNewCondition = false;
+        }
+      }
+      queryString += ")";
+    }
+    const limit = params.allRecords ? 999999 : parseInt(String(params.limit));
+    const query =
+      params.customQuery ||
+      `SELECT
+            ${params.selectExpression || "*"}
+        FROM ${params.table}
+        ${params.join || ""}
+        ${queryString}
+        ${params.groupBy ? "GROUP BY " + params.groupBy : ""}
+        ${params.having ? " HAVING " + params.having : ""}
+        ${params.orderBy || params.primaryId ? " ORDER BY " + (params.orderBy || `${params.table}.${params.primaryId}`) : ""}`;
+    const { err, rows } = await db.query(
+      `${query} LIMIT ${limit} OFFSET ${Math.max((Number(params.page) - 1) * limit, 0)}`,
+    );
+    if (err) {
+      console.error(err);
+      return {
+        error: err,
+      };
+    }
+    const records = readRecordRows(rows);
+    let count: NonNullable<DatabaseRow[string]> | undefined = undefined;
+    if (computeCount) {
+      const { err: countErr, rows: countRows } = await db.query(
+        `SELECT COUNT(*) AS count FROM (${query}) s`,
+      );
+      if (countErr) {
+        const { rows: allRows } = await db.query(query);
+        count = readRecordRows(allRows).length;
+      } else {
+        count = countRows === undefined ? 0 : readRecordRows(countRows)[0]?.count || 0;
+      }
+    }
+
+    return {
+      rows: records,
+      queryString,
+      input: {
+        query,
+        params,
+      },
+      count,
+    };
+  }
+
+  async function findRecordByPosition(params: Omit<RecordQueryParams, "page" | "limit"> & {
+    position: string | number;
+    offset: string | number;
+    page?: string | number;
+    limit?: string | number;
+  }) {
+    return await getRecords(
+      Object.assign(params, {
+        page: parseInt(String(params.position)) + parseInt(String(params.offset)),
+        limit: 1,
+      }),
+    );
+  }
+
+  return { getRecords, findRecordByPosition };
+};

package/src/api/request.ts

@@ -0,0 +1,31 @@
+import type {
+  Column, Config, CreateConfig, ForeignDatalistColumn, StandardColumn,
+  Subview, TablePanel, TableView, View, ViewPanel,
+} from "../types/config";
+
+export type { RequestHandler } from "express";
+
+type Identified = { __id__?: string };
+type RequestColumn = Column & StandardColumn & Identified
+  & Partial<Omit<ForeignDatalistColumn, "dataType">>;
+type RequestPanel = ViewPanel & Identified
+  & Partial<Omit<TablePanel, "type" | "createConfig">> & {
+    columns?: RequestColumn[];
+    createConfig?: CreateConfig & { tableName?: string; columns: RequestColumn[] };
+  };
+type RequestView = View & Identified
+  & Partial<Omit<TableView, "type" | "columns" | "recordViewPanels" | "subviews">> & {
+    columns?: RequestColumn[];
+    __hiddenColumns?: string[];
+    recordViewPanels?: RequestPanel[];
+    subviews?: (Subview & Identified)[];
+  };
+type RequestConfig = Omit<Config, "views"> & { views: RequestView[] };
+
+declare global {
+  namespace Express {
+    interface Request {
+      config?: RequestConfig;
+    }
+  }
+}

package/src/api/routes/adjacentRecordId.ts

@@ -0,0 +1,20 @@
+import type { RequestHandler } from "../request";
+import type createRecordQueries from "../queries";
+import type { DatabaseRow } from "../../utils/dbManager";
+
+type FindRecordByPosition = ReturnType<typeof createRecordQueries>["findRecordByPosition"];
+type RequestBody = Parameters<FindRecordByPosition>[0];
+type ResponseBody = Error | { recordId: DatabaseRow[string] | undefined };
+
+export default (findRecordByPosition: FindRecordByPosition): RequestHandler<Record<string, string>, ResponseBody, RequestBody> =>
+  async function (req, res, next) {
+    const { rows, error } = await findRecordByPosition(req.body);
+    if (error) {
+      return res.status(500).send(error);
+    }
+    // JavaScript coerces an omitted primaryId to the property key "undefined".
+    const recordId = rows[0] ? rows[0][req.body.primaryId as string] : null;
+    res.send({
+      recordId: recordId,
+    });
+  };

package/src/api/routes/config.ts

@@ -0,0 +1,15 @@
+import type { RequestHandler } from "../request";
+import * as serializeJs from "serialize-javascript";
+
+export default (): RequestHandler =>
+  async (req, res) => {
+    try {
+      const { mysql, auth, sessionSecret, ...safeConfig } = req.config!;
+      res.send({
+        config: serializeJs(safeConfig),
+      });
+    } catch (e) {
+      console.error(e);
+      res.sendStatus(500);
+    }
+  };

package/src/api/routes/createRecord.ts

@@ -0,0 +1,131 @@
+import type { RequestHandler } from "../request";
+import type DbManager from "../../utils/dbManager";
+import type { DatabaseRow } from "../../utils/dbManager";
+import axios from "axios";
+import { v4 as uuidv4 } from "uuid";
+import { quoteIdentifier } from "../../utils/dbManager";
+import { areSafeColumnNames, touchesHiddenColumn } from "../authorization";
+
+type RequestBody = {
+  viewIndex: string | number;
+  panelIndex?: string | number | null;
+  recordId?: DatabaseRow[string];
+  data: Partial<DatabaseRow>;
+};
+type ResponseBody =
+  | { id: number | undefined }
+  | { err: unknown; message: string }
+  | { error: string };
+
+export default (db: DbManager): RequestHandler<
+  Record<string, string>,
+  ResponseBody,
+  RequestBody
+> =>
+  async function (req, res, next) {
+    const view = req.config!.views[req.body.viewIndex as number];
+    // panelIndex arrives as a string from the front-end but a numeric caller
+    // may send 0 — only null/undefined mean "no panel".
+    const hasPanel =
+      req.body.panelIndex !== undefined && req.body.panelIndex !== null;
+    const panel = hasPanel
+      ? view.recordViewPanels![req.body.panelIndex as number]
+      : null;
+    if (!hasPanel && touchesHiddenColumn(view, req.body.data)) {
+      return res.sendStatus(403);
+    }
+    try {
+      for (let key in req.body.data) {
+        if (
+          req.body.data[key] == "NULL" ||
+          req.body.data[key] === "Invalid date"
+        ) {
+          req.body.data[key] = null;
+        }
+      }
+      if (panel) {
+        req.body.data[panel.createConfig!.recordIdKey] = req.body.recordId;
+      }
+      const primaryColumn = (view || panel)?.columns?.find(
+        (x) => x.name === (view || panel).primaryId,
+      );
+      if (primaryColumn?.dataType == "uuid") {
+        req.body.data[String(primaryColumn.name)] = uuidv4();
+      }
+      const createPayload = JSON.parse(
+        JSON.stringify(req.body.data),
+      ) as Partial<DatabaseRow>;
+      const columns = panel ? panel.createConfig!.columns : view.columns;
+      for (let key in createPayload) {
+        if (
+          columns?.find((x) => x.name === key)?.includedInCreatePayload ===
+          false
+        ) {
+          delete createPayload[key];
+        }
+      }
+      if (!areSafeColumnNames(createPayload)) {
+        return res.status(400).send({ error: "Invalid column name" });
+      }
+      const queryExpression = Object.keys(createPayload)
+        .map((x) => quoteIdentifier(x, db.dbType!))
+        .join(", ");
+      const queryPlaceholders = Object.keys(createPayload)
+        .map((x) => "?")
+        .join(", ");
+      const queryParameters = Object.keys(createPayload).map(
+        (x) => createPayload[x],
+      );
+      const { err, rows: r } = await db.query(
+        `INSERT INTO ?? (${queryExpression}) VALUES(${queryPlaceholders})`,
+        [panel ? panel.tableName : view.tableName, ...queryParameters],
+      );
+      if (err) {
+        console.error(err);
+        return res.status(500).send({
+          err,
+          message:
+            "code" in err && err.code === "ER_DUP_ENTRY"
+              ? "Cet élément existe déjà."
+              : "Une erreur est survenue.",
+        });
+      }
+      if (panel ? panel.createCallback : view.createCallback) {
+        try {
+          await axios.post(
+            panel ? panel.createCallback! : view.createCallback!,
+            {
+              id: Array.isArray(r) ? undefined : r!.insertId,
+              data: req.body.data,
+            },
+          );
+        } catch (e) {}
+      }
+      if (panel ? panel.createCallbackFunction : view.createCallbackFunction) {
+        // The insert is already committed: a failing callback must not turn
+        // into a 500 that invites a client retry (which would duplicate the
+        // row). Log and answer 200.
+        try {
+          await (
+            panel
+              ? panel.createCallbackFunction!
+              : view.createCallbackFunction!
+          )({
+            id: (Array.isArray(r) ? undefined : r!.insertId) as number, // TODO https://github.com/galadrimteam/galadmin/issues/45: PostgreSQL supplies undefined here.
+            data: req.body.data,
+          });
+        } catch (callbackErr) {
+          console.error(callbackErr);
+        }
+      }
+      res.send({
+        id: Array.isArray(r) ? undefined : r!.insertId,
+      });
+    } catch (err) {
+      console.error(err);
+      res.status(500).send({
+        err,
+        message: "Une erreur est survenue.",
+      });
+    }
+  };

package/src/api/routes/customAction.ts

@@ -0,0 +1,60 @@
+import type { RequestHandler } from "../request";
+import type DbManager from "../../utils/dbManager";
+import type { DatabaseRow } from "../../utils/dbManager";
+
+type RequestBody = {
+  viewIndex: string | number;
+  actionIndex: string | number;
+  selectedRecordIds: DatabaseRow[string][];
+};
+type ResponseBody =
+  | { success: true; message: string | undefined }
+  | { success: false; error: unknown };
+type ActionUser = { userId?: DatabaseRow[string] };
+type QueryRows = NonNullable<Awaited<ReturnType<DbManager["query"]>>["rows"]>;
+type IndexedRows = {
+  [index: number]: Extract<QueryRows, object[]>[number] | undefined;
+};
+
+export default (db: DbManager): RequestHandler<
+  Record<string, string>,
+  ResponseBody,
+  RequestBody
+> =>
+  async function (req, res, next) {
+    const view = req.config!.views[req.body.viewIndex as number];
+    const action = view.customActions![req.body.actionIndex as number];
+    for (const recordId of req.body.selectedRecordIds) {
+      try {
+        const { rows } = await db.query(
+          "SELECT " +
+            (view.selectExpression || "*") +
+            " FROM ?? " +
+            (view.join || "") +
+            " WHERE ?? = ?",
+          [view.tableName, view.tableName + "." + view.primaryId, recordId],
+        );
+        const record = (rows as IndexedRows)[0];
+        const actionResult = await action.action(
+          record,
+          (req.session!.user as ActionUser).userId,
+        );
+        if (actionResult) {
+          return res.send({
+            success: true,
+            message: actionResult,
+          });
+        }
+      } catch (err) {
+        console.error(err);
+        return res.send({
+          success: false,
+          error: err,
+        });
+      }
+    }
+    res.send({
+      success: true,
+      message: action.successMessage,
+    });
+  };

package/src/api/routes/customComponent.ts

@@ -0,0 +1,44 @@
+import type { RequestHandler } from "../request";
+import * as fs from "fs";
+import * as path from "path";
+import * as rollup from "rollup";
+import babel from "@rollup/plugin-babel";
+import resolve from "@rollup/plugin-node-resolve";
+
+export default (__dirname: string): RequestHandler<Record<string, string>, string> =>
+  async (req, res) => {
+    try {
+      const pkg: unknown = JSON.parse(
+        fs.readFileSync(
+          path.join(__dirname, "../src/front/package.json"),
+          "utf-8",
+        ),
+      );
+      const external = Object.keys(
+        (pkg as { dependencies?: unknown }).dependencies || {},
+      );
+      const bundle = await rollup.rollup({
+        input: path.join(
+          __dirname,
+          "../../",
+          req.query.componentPath as string,
+        ),
+        plugins: [
+          resolve(),
+          babel({
+            configFile: path.join(__dirname, "../babel.config"),
+            babelHelpers: "bundled",
+          }),
+        ],
+        external,
+      });
+      const { output } = await bundle.generate({
+        format: "cjs",
+        exports: "auto",
+      });
+      res.send(output[0].code);
+    } catch (err) {
+      console.error(err);
+      res.sendStatus(500);
+    }
+  };

package/src/api/routes/customQuery.ts

@@ -0,0 +1,53 @@
+import type { RequestHandler } from "../request";
+import { collectAllowedQueries } from "../queries";
+import type DbManager from "../../utils/dbManager";
+import type { DatabaseRow } from "../../utils/dbManager";
+
+type QueryRows = NonNullable<Awaited<ReturnType<DbManager["query"]>>["rows"]>;
+type IterableRows = Extract<QueryRows, object[]>;
+type ResponseBody =
+  | Awaited<ReturnType<DbManager["query"]>>["rows"]
+  | Error
+  | { error: string };
+
+export default (db: DbManager): RequestHandler<
+  Record<string, string>,
+  ResponseBody
+> =>
+  async function (req, res, next) {
+      const template =
+        typeof req.query.query === "string" ? req.query.query : "";
+      // SECURITY: only run whitelisted, read-only templates, and bind the record id
+      // as a parameter instead of substituting it into the SQL string.
+      const allowed = collectAllowedQueries(req.config!.views);
+      if (!allowed.has(template.trim())) {
+        return res.status(403).send({ error: "Query not allowed" });
+      }
+      if (!/^\s*\(?\s*(select|with)\b/i.test(template) || /;/.test(template)) {
+        return res
+          .status(400)
+          .send({ error: "Only read-only queries are allowed" });
+      }
+      const placeholderCount = (template.match(/\?/g) || []).length;
+      const params = new Array<typeof req.query.primaryValue>(placeholderCount).fill(
+        req.query.primaryValue,
+      );
+      const { err, rows } = await db.query(template, params);
+      if (err) {
+        return res.status(500).send(err);
+      }
+      if (req.query.viewIndex && req.query.panelIndex) {
+        const panel =
+          req.config!.views[req.query.viewIndex as `${number}`].recordViewPanels![
+            req.query.panelIndex as `${number}`
+          ];
+        if (panel.formatValue) {
+          for (const row of rows as IterableRows) {
+            for (const key in panel.formatValue) {
+              (row as DatabaseRow)[key] = await panel.formatValue[key](row);
+            }
+          }
+        }
+      }
+      res.send(rows);
+    };

package/src/api/routes/deleteRecord.ts

@@ -0,0 +1,59 @@
+import type { RequestHandler } from "../request";
+import type DbManager from "../../utils/dbManager";
+import type { DatabaseRow } from "../../utils/dbManager";
+import axios from "axios";
+
+type RequestBody = {
+  viewIndex: string | number;
+  primaryValue: DatabaseRow[string];
+};
+
+export default (db: DbManager): RequestHandler<
+  Record<string, string>,
+  string | Error,
+  RequestBody
+> =>
+  async function (req, res) {
+    const view = req.config!.views[req.body.viewIndex as number];
+    const { rows, err: err2 } = await db.query(
+      "SELECT " +
+        (view.selectExpression || "*") +
+        " FROM ?? " +
+        (view.join || "") +
+        " WHERE ?? = ?",
+      [
+        view.tableName,
+        view.tableName + "." + view.primaryId,
+        req.body.primaryValue,
+      ],
+    );
+    if (err2) {
+      return res.status(500).send(err2);
+    }
+    const deletedRecord = (rows as DatabaseRow[])[0];
+    if (!deletedRecord) {
+      return res.status(404).send("Record not found");
+    }
+    const { err } = await db.query("DELETE FROM ?? WHERE ?? = ?", [
+      view.tableName,
+      view.primaryId,
+      req.body.primaryValue,
+    ]);
+    if (err) {
+      return res.status(500).send(err);
+    }
+    if (view.deleteCallback) {
+      try {
+        await axios.post(view.deleteCallback, {
+          id: req.body.primaryValue,
+        });
+      } catch (e) {}
+    }
+    if (view.deleteCallbackFunction) {
+      await view.deleteCallbackFunction({
+        id: req.body.primaryValue as number, // TODO https://github.com/galadrimteam/galadmin/issues/45: string and UUID keys are also supplied here.
+        deletedRecord,
+      });
+    }
+    res.sendStatus(200);
+  };

package/src/api/routes/deleteRecordFromPanel.ts

@@ -0,0 +1,58 @@
+import type { RequestHandler } from "../request";
+import type DbManager from "../../utils/dbManager";
+import type { DatabaseRow } from "../../utils/dbManager";
+import axios from "axios";
+
+type RequestBody = {
+  viewIndex: string | number;
+  panelId: string;
+  primaryValue: DatabaseRow[string];
+};
+type DeleteCallbackPayload = {
+  id: number;
+  deletedRecord: DatabaseRow | undefined;
+};
+
+export default (db: DbManager): RequestHandler<
+  Record<string, string>,
+  string | Error,
+  RequestBody
+> =>
+  async function (req, res) {
+    const view = req.config!.views[req.body.viewIndex as number];
+    const panel = view.recordViewPanels!.find(
+      (x) => x.__id__ === req.body.panelId,
+    )!;
+    const { rows, err: err2 } = await db.query(
+      "SELECT * FROM ?? WHERE ?? = ?",
+      [panel.tableName, panel.primaryId, req.body.primaryValue],
+    );
+    if (err2) {
+      return res.status(500).send(err2);
+    }
+    const deletedRecord = (rows as (DatabaseRow | undefined)[])[0];
+    const { err } = await db.query("DELETE FROM ?? WHERE ?? = ?", [
+      panel.tableName,
+      panel.primaryId,
+      req.body.primaryValue,
+    ]);
+    if (err) {
+      return res.status(500).send(err);
+    }
+    if (panel.deleteCallback) {
+      try {
+        await axios.post(panel.deleteCallback, {
+          id: req.body.primaryValue,
+        });
+      } catch (e) {}
+    }
+    if (panel.deleteCallbackFunction) {
+      await (panel.deleteCallbackFunction as (
+        payload: DeleteCallbackPayload,
+      ) => void)({
+        id: req.body.primaryValue as number, // TODO https://github.com/galadrimteam/galadmin/issues/45: string and UUID keys are also supplied here.
+        deletedRecord,
+      });
+    }
+    res.sendStatus(200);
+  };