@galadrim/galadmin 0.2.12 → 0.3.0-alpha.2.1

package/src/api.ts

@@ -1,230 +1,60 @@
 import * as express from "express";
-import * as multiparty from "multiparty";
-import * as fs from "fs";
-import * as path from "path";
-import * as crypto from "crypto";
-import * as mime from "mime";
-
-import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import { Storage } from "@google-cloud/storage";
-import { getImageDimensions } from "./utils/imageDimensions";
-import * as serializeJs from "serialize-javascript";
-import * as SftpClient from "ssh2-sftp-client";
-
-import * as rollup from "rollup";
-import babel from "@rollup/plugin-babel";
-import resolve from "@rollup/plugin-node-resolve";
-import axios from "axios";
-import { v4 as uuidv4 } from "uuid";
-
-import { quoteIdentifier } from "./utils/dbManager";
-
-export function generateUniqueIdForObject(obj) {
-  const str = JSON.stringify(obj);
-  const hash = crypto.createHash("sha256").update(str).digest("hex");
-  return hash;
-}
-
-// ---------------------------------------------------------------------------
-// SECURITY: server-side authorization.
-//
-// The config-filtering middleware below only decides which views the *client*
-// is shown, and sets canEdit/canCreate/canDelete flags on that served config.
-// Nothing enforced those decisions server-side, so a session with the lowest
-// role could POST directly to /updateRecord, /deleteRecord, /customQuery, …
-// and act on any view — including read-only ones — as the DB user (root).
-// This block re-checks every sensitive route against the view's declared roles.
-// ---------------------------------------------------------------------------
-export const ROOT_ROLE = "root";
-export const roleOf = (req) =>
-  req.session && req.session.user && req.session.user.role;
-// Write access = the view's `roles` (root always allowed).
-export const canWriteView = (view, role) =>
-  role === ROOT_ROLE || !view || !view.roles || view.roles.includes(role);
-
-export const viewFromRequest = (req) => {
-  const idx =
-    req.body && req.body.viewIndex !== undefined
-      ? req.body.viewIndex
-      : req.query && req.query.viewIndex !== undefined
-        ? req.query.viewIndex
-        : undefined;
-  if (idx === undefined || !req.config || !req.config.views) return undefined;
-  return req.config.views[idx];
-};
-
-// Routes that mutate data and reference their target view via viewIndex
-// (body for POST bodies, query for /uploadFile). Import routes carry the
-// viewIndex inside a multipart body and are guarded inline in their handlers.
-export const MUTATING_VIEW_ROUTES = new Set([
-  "/updateRecord",
-  "/createRecord",
-  "/deleteRecord",
-  "/deleteRecords",
-  "/deleteRecordFromPanel",
-  "/customAction",
-  "/uploadFile",
-]);
-// /duplicateRecord references its table via req.body.table (not a viewIndex),
-// so it is guarded inline in its handler instead of by the generic middleware.
-
-// Column names are interpolated into INSERT/UPDATE statements; only accept plain
-// SQL identifiers so a crafted key cannot break out of the column list.
-export const areSafeColumnNames = (data) =>
-  !data || Object.keys(data).every((k) => /^[A-Za-z0-9_]+$/.test(k));
-
-// Tables the current role is allowed to write, gathered from its writable views
-// and their creatable panels — used to bound /duplicateRecord's target table.
-export const writableTables = (req) => {
-  const role = roleOf(req);
-  const tables = new Set<string>();
-  for (const view of req.config?.views || []) {
-    if (!canWriteView(view, role)) continue;
-    if (view.tableName) tables.add(view.tableName);
-    for (const panel of view.recordViewPanels || []) {
-      if (panel.tableName) tables.add(panel.tableName);
-      if (panel.createConfig?.tableName)
-        tables.add(panel.createConfig.tableName);
-    }
-  }
-  return tables;
-};
-
-// Reject client-supplied SQL fragments (the `filters` array is concatenated
-// raw into the WHERE clause). With multipleStatements off this already blocks
-// stacked writes; the pattern also blocks UNION/comment/file exfil breakouts.
-export const looksLikeSqlBreakout = (frag) =>
-  typeof frag === "string" &&
-  /(;|--|\/\*|\bunion\b|\binto\s+(out|dump)file\b|\bsleep\s*\(|\bbenchmark\s*\(|\bload_file\s*\()/i.test(
-    frag,
-  );
-
-export function sqlAnd(conditions) {
-  const existingConditions = [];
-  for (const condition of conditions) {
-    if (condition && condition.length > 0) {
-      existingConditions.push(condition);
-    }
-  }
-  if (existingConditions.length <= 1) {
-    return existingConditions[0] || null;
-  } else {
-    let result = "";
-    for (let i = 0; i < existingConditions.length; i++) {
-      if (i > 0) {
-        result += " AND ";
-      }
-      result += "(" + existingConditions[i] + ")";
-    }
-    return result;
-  }
-}
-
-export async function getFormattedValue(column, record) {
-  let value;
-  try {
-    record.options = column.options;
-    if (column.formatValueForExport) {
-      value = await column.formatValueForExport(record);
-    } else if (column.formattedValue) {
-      value = evalExpression(column.formattedValue, record);
-    } else if (column.formatValue) {
-      value = await column.formatValue(record);
-    } else if (column.dataType == "tinyint") {
-      value = record[column.name] == 1 ? "Oui" : "Non";
-    } else {
-      value = record[column.name];
-    }
-    return value === null || typeof value == "undefined" ? "" : value;
-  } catch (err) {
-    return value || "";
-  }
-}
-
-export function evalExpression(expression, data) {
-  let varString = "";
-  let statement = "";
-
-  try {
-    for (let key in data) {
-      statement =
-        "var " +
-        key +
-        " = " +
-        (typeof data[key] === "string"
-          ? "'" +
-            data[key]
-              .replace(/'/g, "\\'")
-              .replace(/\n/g, "")
-              .replace(/\r/g, "") +
-            "'"
-          : typeof data[key] === "object"
-            ? JSON.stringify(data[key])
-            : data[key]) +
-        ";";
-      varString += statement;
-    }
-    const result = eval(varString + expression);
-    return result;
-  } catch (e) {
-    console.log("Problème d'évaluation de l'expression", statement);
-    console.error(e);
-    return "Error";
-  }
-}
-
-export function formatValueForInsertion(value: any, dbType: string) {
-  if (value !== 0 && !value) {
-    return "NULL";
-  }
-  if (value instanceof Date) {
-    return value.toISOString();
-  }
-  if (typeof value === "string") {
-    if (dbType === "POSTGRESQL") {
-      return "'" + value.replace(/'/g, "''") + "'";
-    } else {
-      return "'" + value.replace(/'/g, "\\'") + "'";
-    }
-  }
-  if (typeof value === "object") {
-    return "'" + JSON.stringify(value).replace(/'/g, "\\'") + "'";
-  }
-  if (typeof value === "boolean") {
-    return value ? "TRUE" : "FALSE";
-  }
-  if (typeof value === "number") {
-    return value;
-  }
-
-  return value;
-}
-
-declare global {
-  namespace Express {
-    interface Request {
-      config?: any;
-    }
-  }
-}
-
-// Columns of `view` the current role may not see (cf. the config middleware below).
-export const hiddenColumnsOf = (view) => (view && view.__hiddenColumns) || [];
-
-// Removes the hidden columns from a record before it is sent.
-export const stripHiddenColumns = (view, record) => {
-  for (const name of hiddenColumnsOf(view)) delete record[name];
-  return record;
-};
-
-// Whether a write payload touches a hidden column.
-export const touchesHiddenColumn = (view, data) =>
-  hiddenColumnsOf(view).some(
-    (name) => data && Object.prototype.hasOwnProperty.call(data, name),
-  );
-
-export default (db, config) => {
+import type { Config, Column, StandardColumn } from "./types/config";
+import type DbManager from "./utils/dbManager";
+import "./api/request";
+import {
+  roleOf,
+  canWriteView,
+  viewFromRequest,
+  MUTATING_VIEW_ROUTES,
+  looksLikeSqlBreakout,
+} from "./api/authorization";
+import { enrichConfig } from "./api/config";
+import createRecordQueries, { collectAllowedQueries } from "./api/queries";
+import configRoute from "./api/routes/config";
+import customComponentRoute from "./api/routes/customComponent";
+import adjacentRecordIdRoute from "./api/routes/adjacentRecordId";
+import foreignSelectRecordsRoute from "./api/routes/foreignSelectRecords";
+import recordsRoute from "./api/routes/records";
+import recordsExportRoute from "./api/routes/recordsExport";
+import recordsImportRoute from "./api/routes/recordsImport";
+import subrecordsImportRoute from "./api/routes/subrecordsImport";
+import recordRoute from "./api/routes/record";
+import updateRecordRoute from "./api/routes/updateRecord";
+import customActionRoute from "./api/routes/customAction";
+import deleteRecordRoute from "./api/routes/deleteRecord";
+import deleteRecordFromPanelRoute from "./api/routes/deleteRecordFromPanel";
+import deleteRecordsRoute from "./api/routes/deleteRecords";
+import notificationBadgesRoute from "./api/routes/notificationBadges";
+import duplicateRecordRoute from "./api/routes/duplicateRecord";
+import createRecordRoute from "./api/routes/createRecord";
+import customQueryRoute from "./api/routes/customQuery";
+import uploadFileFromBetterRichTextInputRoute from "./api/routes/uploadFileFromBetterRichTextInput";
+import uploadFileRoute from "./api/routes/uploadFile";
+import searchCompaniesRoute from "./api/routes/searchCompanies";
+
+export {
+  ROOT_ROLE,
+  roleOf,
+  canWriteView,
+  viewFromRequest,
+  MUTATING_VIEW_ROUTES,
+  areSafeColumnNames,
+  writableTables,
+  hiddenColumnsOf,
+  stripHiddenColumns,
+  touchesHiddenColumn,
+  looksLikeSqlBreakout,
+} from "./api/authorization";
+export { generateUniqueIdForObject, enrichConfig, enrichColumn } from "./api/config";
+export { sqlAnd, collectAllowedQueries } from "./api/queries";
+export {
+  getFormattedValue,
+  evalExpression,
+  formatValueForInsertion,
+} from "./api/values";
+
+export default (db: DbManager, config: Config) => {
   const app = express();
 
   app.use((req, res, next) => {
@@ -234,21 +64,21 @@ export default (db, config) => {
         .filter(
           (x) =>
             !x.roles ||
-            (req.session.user &&
+            (req.session!.user &&
               [...(x.roles || []), ...(x.readRoles || [])].includes(
-                req.session.user.role,
+                req.session!.user.role,
               )),
         )
         .map((view) => {
           const readOnly =
-            req.session.user &&
+            req.session!.user &&
             view.roles &&
-            !view.roles.includes(req.session.user.role);
+            !view.roles.includes(req.session!.user.role);
           if (readOnly) {
             return {
               ...view,
               canEdit: false,
-              canCreate: false,
+              canCreate: false as const,
               canDelete: false,
               clickToEdit: false,
             };
@@ -258,10 +88,10 @@ export default (db, config) => {
         })
         .map((view) => {
           if (view.type === "table") {
-            const allowed = (column) =>
+            const allowed = (column: Column) =>
               !column.roles ||
-              (req.session.user &&
-                column.roles.includes(req.session.user.role));
+              (req.session!.user &&
+                column.roles.includes(req.session!.user.role));
             return {
               ...view,
               columns: view.columns.filter(allowed),
@@ -270,7 +100,12 @@ export default (db, config) => {
               // here, stripped from every record sent back and refused in every write.
               __hiddenColumns: view.columns
                 .filter((column) => !allowed(column))
-                .map((column) => column.name),
+                .map((column: Column & StandardColumn) => column.name)
+                /*
+                #PORTING-EDIT
+                Nullish names cannot identify protected database fields; excluding them avoids treating missing names as literal "undefined" or "null" keys.
+                */
+                .filter((name): name is string => name != null),
             };
           } else {
             return view;
@@ -281,8 +116,8 @@ export default (db, config) => {
   });
 
   app.use(async (req, res, next) => {
-    if (!req.config.enriched) {
-      await enrichConfig(req.config, db);
+    if (!req.config!.enriched) {
+      await enrichConfig(req.config!, db);
     }
     next();
   });
@@ -314,960 +149,43 @@ export default (db, config) => {
     next();
   });
 
-  async function getRecords(params, computeCount = false) {
-    let queryString = "";
-    if (params.filters) {
-      queryString = " WHERE (" + params.filters + ")";
-    }
-    if (params.query) {
-      const columns = params.columns;
-      let isNewCondition = true;
-      for (let i in columns) {
-        if (
-          columns[i].searchable !== false &&
-          (columns[i].searchableName || columns[i].name)
-        ) {
-          if (queryString.length == 0) {
-            queryString += " WHERE (";
-          } else if (isNewCondition) {
-            queryString += " AND (";
-          } else {
-            queryString += " OR ";
-          }
-          if (columns[i].searchableName) {
-            // on ne doit pas ajouter de backticks sur le searchableName car celui-ci peut être une fonction
-            // exemple : searchableName = "CONCAT_WS(' ', firstname, lastname)"
-            queryString += columns[i].searchableName;
-          } else if (columns[i].name) {
-            queryString += columns[i].name
-              .split(".")
-              .map((x) => quoteIdentifier(x, db.dbType))
-              .join(".");
-          }
-          // SECURITY: escape the user query per dialect — PostgreSQL does not
-          // treat backslashes as escapes inside standard strings, so a `\'`
-          // would terminate the literal early.
-          const searchEscaped =
-            db.dbType === "POSTGRESQL"
-              ? params.query.replace(/'/g, "''")
-              : params.query.replace(/'/g, "\\'");
-          queryString += " LIKE '%" + searchEscaped + "%'";
-          isNewCondition = false;
-        }
-      }
-      queryString += ")";
-    }
-    const limit = params.allRecords ? 999999 : parseInt(params.limit);
-    const query =
-      params.customQuery ||
-      `SELECT
-            ${params.selectExpression || "*"}
-        FROM ${params.table}
-        ${params.join || ""}
-        ${queryString}
-        ${params.groupBy ? "GROUP BY " + params.groupBy : ""}
-        ${params.having ? " HAVING " + params.having : ""}
-        ${params.orderBy || params.primaryId ? " ORDER BY " + (params.orderBy || `${params.table}.${params.primaryId}`) : ""}`;
-    const { err, rows } = await db.query(
-      `${query} LIMIT ${limit} OFFSET ${Math.max((params.page - 1) * limit, 0)}`,
-    );
-    if (err) {
-      console.error(err);
-      return {
-        error: err,
-      };
-    }
-    let count = undefined;
-    if (computeCount) {
-      const { err: countErr, rows: countRows } = await db.query(
-        `SELECT COUNT(*) AS count FROM (${query}) s`,
-      );
-      if (countErr) {
-        const { rows: allRows } = await db.query(query);
-        count = allRows.length;
-      } else {
-        count = countRows?.[0]?.count || 0;
-      }
-    }
-
-    return {
-      rows,
-      queryString,
-      input: {
-        query,
-        params,
-      },
-      count,
-    };
-  }
-
-  async function findRecordByPosition(params) {
-    return await getRecords(
-      Object.assign(params, {
-        page: parseInt(params.position) + parseInt(params.offset),
-        limit: 1,
-      }),
-    );
-  }
-
-  app.get("/config", async (req, res) => {
-    try {
-      const { mysql, auth, sessionSecret, ...safeConfig } = req.config;
-      res.send({
-        config: serializeJs(safeConfig),
-      });
-    } catch (e) {
-      console.error(e);
-      res.sendStatus(500);
-    }
-  });
+  const { getRecords, findRecordByPosition } = createRecordQueries(db);
 
-  app.get("/customComponent", async (req, res) => {
-    try {
-      const pkg = JSON.parse(
-        fs.readFileSync(
-          path.join(__dirname, "../src/front/package.json"),
-          "utf-8",
-        ),
-      );
-      const external = Object.keys(pkg.dependencies || {});
-      const bundle = await rollup.rollup({
-        input: path.join(
-          __dirname,
-          "../../",
-          req.query.componentPath as string,
-        ),
-        plugins: [
-          resolve(),
-          babel({
-            configFile: path.join(__dirname, "../babel.config"),
-            babelHelpers: "bundled",
-          }),
-        ],
-        external,
-      });
-      const { output } = await bundle.generate({
-        format: "cjs",
-        exports: "auto",
-      });
-      res.send(output[0].code);
-    } catch (err) {
-      console.error(err);
-      res.sendStatus(500);
-    }
-  });
+  app.get("/config", configRoute());
 
-  app.post("/adjacentRecordId", async function (req, res, next) {
-    const { rows, error } = await findRecordByPosition(req.body);
-    if (error) {
-      return res.status(500).send(error);
-    }
-    const recordId = rows[0] ? rows[0][req.body.primaryId] : null;
-    res.send({
-      recordId: recordId,
-    });
-  });
+  app.get("/customComponent", customComponentRoute(__dirname));
 
-  app.post("/foreignSelectRecords", async (req, res, next) => {
-    const view = req.config.views[req.body.viewIndex];
-    const column = [
-      ...view.columns,
-      ...(view.recordViewPanels
-        ?.map((x) => x?.createConfig?.columns)
-        ?.filter((x) => x)
-        ?.flat() || []),
-    ].find((x) => x.__id__ === req.body.columnId);
-    const queryEscaped =
-      db.dbType === "POSTGRESQL"
-        ? req.body.query?.replace(/'/g, "''")
-        : req.body.query?.replace(/'/g, "\\'");
-    const { rows: records, error } = await getRecords({
-      table: column.table,
-      page: 1,
-      filters: sqlAnd([
-        column.filters,
-        req.body.query
-          ? `${column.searchableName} LIKE '${column.wholeSearch ? "%" : ""}${queryEscaped}%'`
-          : null,
-        column.filtersFromUser
-          ? column.filtersFromUser(
-              req.session.user.userId,
-              req.session.user.role,
-            )
-          : null,
-      ]),
-      join: column.join,
-      selectExpression: column.selectExpression,
-      orderBy: column.orderBy,
-      limit: column.limit || 1000,
-    });
-    if (error) {
-      return res.status(500).send(error);
-    }
-    const options = await Promise.all(
-      records.map(async (record) => {
-        let label;
-        if (column.formatForeignValue) {
-          label = await column.formatForeignValue(record);
-        } else if (column.formatValue) {
-          label = await column.formatValue(record);
-        } else if (column.formattedValue) {
-          label = evalExpression(column.formattedValue, record);
-        } else {
-          label = record[column.name];
-        }
-        const value = record[column.foreignName] || record[column.name];
-        return {
-          value,
-          label,
-        };
-      }),
-    );
-    res.send(options);
-  });
+  app.post("/adjacentRecordId", adjacentRecordIdRoute(findRecordByPosition));
 
-  app.post("/records", async function (req, res, next) {
-    const view = req.config.views[req.body.viewIndex];
-    const isDesc = req.body.isDesc === null ? view.isDesc : req.body.isDesc;
-    const subview =
-      view.subviews && req.body.subviewIndex !== undefined
-        ? view.subviews[req.body.subviewIndex]
-        : null;
-    const orderBy = req.body.orderBy || subview?.orderBy || view.orderBy;
-    const {
-      rows: records,
-      input,
-      error,
-      count,
-    } = await getRecords(
-      {
-        table: view.tableName,
-        page: req.body.page,
-        filters: sqlAnd([
-          view.filters,
-          subview?.filters,
-          ...req.body.filters,
-          view.filtersFromUser
-            ? view.filtersFromUser(
-                req.session.user.userId,
-                req.session.user.role,
-              )
-            : null,
-        ]),
-        having: subview?.having,
-        customQuery: view.customQuery,
-        join: view.join,
-        selectExpression: view.selectExpression,
-        orderBy: [
-          orderBy ? `${orderBy} ${isDesc ? "DESC" : "ASC"}` : null,
-          view.primaryId,
-        ]
-          .filter((x) => x)
-          .join(", "),
-        primaryId: view.primaryId,
-        query: req.body.query,
-        groupBy: view.groupBy,
-        columns: view.columns,
-        limit: view.limit || 10,
-      },
-      true,
-    );
-    if (error) {
-      return res.status(500).send(error);
-    }
+  app.post("/foreignSelectRecords", foreignSelectRecordsRoute(db, getRecords));
 
-    for (const column of view.columns) {
-      if (column.formatValue) {
-        for (const record of records) {
-          record[`__formatValue-${column.__id__}__`] =
-            await column.formatValue(record);
-        }
-      }
-    }
-    for (const record of records) stripHiddenColumns(view, record);
-    res.send({
-      records,
-      input,
-      count,
-    });
-  });
+  app.post("/records", recordsRoute(getRecords));
 
   const formattedValueToFunction = {};
 
-  app.post("/recordsExport", async function (req, res) {
-    const view = req.config.views[req.body.viewIndex];
-    const orderBy = req.body.orderBy || view.orderBy;
-    const isDesc = req.body.isDesc === null ? view.isDesc : req.body.isDesc;
-    const subview =
-      view.subviews && req.body.subviewIndex !== undefined
-        ? view.subviews[req.body.subviewIndex]
-        : null;
-    const { rows: records, error } = await getRecords({
-      table: view.tableName,
-      page: 1,
-      allRecords: true,
-      filters: sqlAnd([
-        view.filters,
-        subview?.filters,
-        req.body.filters,
-        // SECURITY: scope the export exactly like the list view, otherwise a
-        // user could download rows their filtersFromUser clause hides.
-        view.filtersFromUser
-          ? view.filtersFromUser(
-              req.session.user.userId,
-              req.session.user.role,
-            )
-          : null,
-      ]),
-      having: subview?.having,
-      customQuery: view.customQuery,
-      join: view.join,
-      selectExpression: view.selectExpression,
-      orderBy: orderBy ? `${orderBy} ${isDesc ? "DESC" : "ASC"}` : null,
-      primaryId: view.primaryId,
-      query: req.body.query,
-      groupBy: view.groupBy,
-      columns: view.columns,
-      limit: view.limit || 10,
-    });
-    if (error) {
-      return res.status(500).send(error);
-    }
-    let output = "";
-    const columns = view.columns;
-    for (let j = 0; j < columns.length; j++) {
-      if (!columns[j].hideInTable || columns[j].includeInExport) {
-        if (j > 0) output += ";";
-        output += columns[j].label;
-      }
-    }
-    for (let i in records) {
-      const el = records[i];
-      output += "\r\n";
-      for (let j = 0; j < columns.length; j++) {
-        if (!columns[j].hideInTable || columns[j].includeInExport) {
-          if (j > 0) output += ";";
-          if (columns[j].dataType == "textarea") {
-            output += '"';
-          }
-          output += await getFormattedValue(columns[j], el);
-          if (columns[j].dataType == "textarea") {
-            output += '"';
-          }
-        }
-      }
-    }
-    res.send({
-      content: output,
-    });
-  });
-
-  app.post("/recordsImport", async function (req, res) {
-    const form = new multiparty.Form();
-    form.parse(req, async function (err, fields, files) {
-      if (err) {
-        return res.status(500).send(err);
-      }
-      // Get viewIndex in fields
-      const view = req.config.views[fields.viewIndex[0]];
-      // SECURITY: the generic write-guard cannot see a viewIndex buried in a
-      // multipart body, so imports enforce the view's write roles here.
-      if (!view || !canWriteView(view, roleOf(req))) {
-        return res.sendStatus(403);
-      }
-      if (typeof view.parseImportFile !== "function") {
-        return res
-          .status(500)
-          .send(
-            '"parseImportFile" doit être défini dans la configuration de la vue.',
-          );
-      }
-
-      const records = await view.parseImportFile(files.data[0]);
-      const columns = [];
-      if (records.length === 0) {
-        return res.send({
-          affectedRows: 0,
-        });
-      }
-
-      try {
-        for (let record of records) {
-          for (let key in record) {
-            if (!columns.includes(key)) {
-              columns.push(key);
-            }
-          }
-        }
-        if (columns.some((name) => hiddenColumnsOf(view).includes(name))) {
-          return res.sendStatus(403);
-        }
-
-        let queryString;
-        if (db.dbType === "POSTGRESQL") {
-          queryString = `INSERT INTO ?? (${columns.map((x) => quoteIdentifier(x, db.dbType)).join(", ")}) VALUES`;
-
-          for (let record of records) {
-            const valuesList = columns
-              .map((x) => formatValueForInsertion(record[x], db.dbType))
-              .join(", ");
-            queryString += ` (${valuesList}),`;
-          }
-          queryString =
-            queryString.slice(0, -1) +
-            ` ON CONFLICT (${view.importFileUniqueField}) DO UPDATE SET `;
-
-          for (let column of columns) {
-            queryString += `${quoteIdentifier(column, db.dbType)} = EXCLUDED.${quoteIdentifier(column, db.dbType)},`;
-          }
-        } else {
-          queryString =
-            "INSERT INTO ?? (" +
-            columns.map((x) => quoteIdentifier(x, db.dbType)).join(", ") +
-            ") VALUES";
-          for (let record of records) {
-            queryString +=
-              " (" +
-              columns
-                .map((x) => formatValueForInsertion(record[x], db.dbType))
-                .join(", ") +
-              "),";
-          }
-          queryString = queryString.slice(0, -1) + " ON DUPLICATE KEY UPDATE";
-          for (let column of columns) {
-            queryString += ` ${quoteIdentifier(column, db.dbType)} = VALUES(${quoteIdentifier(column, db.dbType)}),`;
-          }
-        }
-        queryString = queryString.slice(0, -1); // Remove the trailing comma
-
-        const { err, rows: r } = await db.query(queryString, [view.tableName]);
-        if (err) {
-          console.error(err);
-          return res.status(500).send({
-            err,
-            message: "Une erreur est survenue.",
-          });
-        }
-        res.send({
-          affectedRows: r.affectedRows,
-        });
-      } catch (err) {
-        console.error(err);
-        res.status(500).send({
-          err,
-          message: "Une erreur est survenue.",
-        });
-      }
-    });
-  });
-
-  app.post("/subrecordsImport", async function (req, res) {
-    const form = new multiparty.Form();
-    form.parse(req, async function (err, fields, files) {
-      if (err) {
-        return res.status(500).send(err);
-      }
-      // Get viewIndex and panelIndex in fields
-      const view = req.config.views[fields.viewIndex[0]];
-      const panel = view
-        ? view.recordViewPanels[fields.panelIndex[0]]
-        : undefined;
-      // SECURITY: same write-guard as /recordsImport, plus the panel's own
-      // roles when it declares any.
-      if (
-        !view ||
-        !canWriteView(view, roleOf(req)) ||
-        !panel ||
-        !canWriteView(panel, roleOf(req))
-      ) {
-        return res.sendStatus(403);
-      }
-      if (typeof panel.parseImportFile !== "function") {
-        return res
-          .status(500)
-          .send(
-            '"parseImportFile" doit être défini dans la configuration du panneau.',
-          );
-      }
-      if (!Boolean(panel.createConfig)) {
-        return res
-          .status(500)
-          .send(
-            '"createConfig" doit être défini dans la configuration du panneau.',
-          );
-      }
-
-      const records = await panel.parseImportFile(
-        files.data[0],
-        fields.recordId[0],
-      );
-      const columns = [];
-      if (records.length === 0) {
-        return res.send({
-          affectedRows: 0,
-        });
-      }
-
-      try {
-        for (let record of records) {
-          for (let key in record) {
-            if (!columns.includes(key)) {
-              columns.push(key);
-            }
-          }
-        }
+  app.post("/recordsExport", recordsExportRoute(getRecords));
 
-        let queryString =
-          "INSERT IGNORE INTO ?? (" +
-          quoteIdentifier(panel.createConfig.recordIdKey, db.dbType) +
-          ", " +
-          columns.map((x) => quoteIdentifier(x, db.dbType)).join(", ") +
-          ") VALUES";
-        for (let record of records) {
-          queryString +=
-            " (" +
-            fields.recordId[0] +
-            ", " +
-            columns
-              .map((x) => formatValueForInsertion(record[x], db.dbType))
-              .join(", ") +
-            "),";
-        }
-        queryString = queryString.slice(0, -1) + " ON DUPLICATE KEY UPDATE";
-        for (let column of columns) {
-          queryString += ` ${quoteIdentifier(column, db.dbType)} = VALUES(${quoteIdentifier(column, db.dbType)}),`;
-        }
-        const { err, rows: r } = await db.query(queryString.slice(0, -1), [
-          panel.tableName,
-        ]);
-        if (err) {
-          console.error(err);
-          return res.status(500).send({
-            err,
-            message: "Une erreur est survenue.",
-          });
-        }
-        res.send({
-          affectedRows: r.affectedRows,
-        });
-      } catch (err) {
-        console.error(err);
-        res.status(500).send({
-          err,
-          message: "Une erreur est survenue.",
-        });
-      }
-    });
-  });
+  app.post("/recordsImport", recordsImportRoute(db));
 
-  app.get("/record", async function (req, res) {
-    const view = req.config.views[req.query.viewIndex as string];
-    const { err, rows } = await db.query(
-      "SELECT " +
-        (view.selectExpression || "*") +
-        " FROM ?? " +
-        (view.join || "") +
-        " WHERE ?? = ?",
-      [
-        view.tableName,
-        view.tableName + "." + view.primaryId,
-        req.query.recordId,
-      ],
-    );
-    if (err) {
-      return res.status(500).send(err);
-    }
-    if (rows.length > 0) {
-      const record = rows[0];
-      for (const column of view.columns) {
-        if (column.formatValue) {
-          record[`__formatValue-${column.__id__}__`] =
-            await column.formatValue(record);
-        }
-      }
-      res.send(stripHiddenColumns(view, record));
-    } else {
-      res.sendStatus(404);
-    }
-  });
+  app.post("/subrecordsImport", subrecordsImportRoute(db));
 
-  app.post("/updateRecord", async function (req, res, next) {
-    const view = req.config.views[req.body.viewIndex];
-    if (!areSafeColumnNames(req.body.data)) {
-      return res.status(400).send({ error: "Invalid column name" });
-    }
-    if (touchesHiddenColumn(view, req.body.data)) {
-      return res.sendStatus(403);
-    }
-    for (let key in req.body.data) {
-      if (
-        req.body.data[key] == "NULL" ||
-        req.body.data[key] === "" ||
-        req.body.data[key] === "Invalid date"
-      ) {
-        req.body.data[key] = null;
-      }
-    }
-    if (Object.keys(req.body.data).length === 0) {
-      return res.sendStatus(200);
-    }
-    const queryExpression = Object.keys(req.body.data)
-      .map((x) => `${quoteIdentifier(x, db.dbType)} = ?`)
-      .join(", ");
-    const queryParameters = Object.keys(req.body.data).map(
-      (x) => req.body.data[x],
-    );
-    const { err } = await db.query(
-      `UPDATE ?? SET ${queryExpression} WHERE ?? = ?`,
-      [
-        view.tableName,
-        ...queryParameters,
-        view.primaryId,
-        req.body.primaryValue,
-      ],
-    );
-    if (err) {
-      return res.status(500).send(err);
-    }
-    if (view.editCallback) {
-      try {
-        await axios.post(view.editCallback, {
-          id: req.body.primaryValue,
-          data: req.body.data,
-          previousData: req.body.previousData,
-        });
-      } catch (e) {}
-    }
-    if (view.editCallbackFunction) {
-      await view.editCallbackFunction({
-        id: req.body.primaryValue,
-        data: req.body.data,
-      });
-    }
-    res.sendStatus(200);
-  });
+  app.get("/record", recordRoute(db));
 
-  app.post("/customAction", async function (req, res, next) {
-    const view = req.config.views[req.body.viewIndex];
-    const action = view.customActions[req.body.actionIndex];
-    for (const recordId of req.body.selectedRecordIds) {
-      try {
-        const { rows } = await db.query(
-          "SELECT " +
-            (view.selectExpression || "*") +
-            " FROM ?? " +
-            (view.join || "") +
-            " WHERE ?? = ?",
-          [view.tableName, view.tableName + "." + view.primaryId, recordId],
-        );
-        const record = rows[0];
-        const actionResult = await action.action(
-          record,
-          req.session.user.userId,
-        );
-        if (actionResult) {
-          return res.send({
-            success: true,
-            message: actionResult,
-          });
-        }
-      } catch (err) {
-        console.error(err);
-        return res.send({
-          success: false,
-          error: err,
-        });
-      }
-    }
-    res.send({
-      success: true,
-      message: action.successMessage,
-    });
-  });
+  app.post("/updateRecord", updateRecordRoute(db));
 
-  app.post("/deleteRecord", async function (req, res) {
-    const view = req.config.views[req.body.viewIndex];
-    const { rows, err: err2 } = await db.query(
-      "SELECT " +
-        (view.selectExpression || "*") +
-        " FROM ?? " +
-        (view.join || "") +
-        " WHERE ?? = ?",
-      [
-        view.tableName,
-        view.tableName + "." + view.primaryId,
-        req.body.primaryValue,
-      ],
-    );
-    if (err2) {
-      return res.status(500).send(err2);
-    }
-    const deletedRecord = rows[0];
-    if (!deletedRecord) {
-      return res.status(404).send("Record not found");
-    }
-    const { err } = await db.query("DELETE FROM ?? WHERE ?? = ?", [
-      view.tableName,
-      view.primaryId,
-      req.body.primaryValue,
-    ]);
-    if (err) {
-      return res.status(500).send(err);
-    }
-    if (view.deleteCallback) {
-      try {
-        await axios.post(view.deleteCallback, {
-          id: req.body.primaryValue,
-        });
-      } catch (e) {}
-    }
-    if (view.deleteCallbackFunction) {
-      await view.deleteCallbackFunction({
-        id: req.body.primaryValue,
-        deletedRecord,
-      });
-    }
-    res.sendStatus(200);
-  });
+  app.post("/customAction", customActionRoute(db));
 
-  app.post("/deleteRecordFromPanel", async function (req, res) {
-    const view = req.config.views[req.body.viewIndex];
-    const panel = view.recordViewPanels.find(
-      (x) => x.__id__ === req.body.panelId,
-    );
-    const { rows, err: err2 } = await db.query(
-      "SELECT * FROM ?? WHERE ?? = ?",
-      [panel.tableName, panel.primaryId, req.body.primaryValue],
-    );
-    if (err2) {
-      return res.status(500).send(err2);
-    }
-    const deletedRecord = rows[0];
-    const { err } = await db.query("DELETE FROM ?? WHERE ?? = ?", [
-      panel.tableName,
-      panel.primaryId,
-      req.body.primaryValue,
-    ]);
-    if (err) {
-      return res.status(500).send(err);
-    }
-    if (panel.deleteCallback) {
-      try {
-        await axios.post(panel.deleteCallback, {
-          id: req.body.primaryValue,
-        });
-      } catch (e) {}
-    }
-    if (panel.deleteCallbackFunction) {
-      await panel.deleteCallbackFunction({
-        id: req.body.primaryValue,
-        deletedRecord,
-      });
-    }
-    res.sendStatus(200);
-  });
+  app.post("/deleteRecord", deleteRecordRoute(db));
 
-  app.post("/deleteRecords", async function (req, res, next) {
-    const view = req.config.views[req.body.viewIndex];
-    // SECURITY: bind the primary values as parameters instead of interpolating
-    // them into the IN() list (quote-bearing values could break out).
-    const placeholders = req.body.primaryValues.map(() => "?").join(", ");
-    const { err } = await db.query(
-      `DELETE FROM ?? WHERE ?? IN(${placeholders})`,
-      [view.tableName, view.primaryId, ...req.body.primaryValues],
-    );
-    if (err) {
-      return res.status(500).send(err);
-    }
-    res.sendStatus(200);
-  });
+  app.post("/deleteRecordFromPanel", deleteRecordFromPanelRoute(db));
 
-  app.get("/notificationBadges", async function (req, res) {
-    const notificationBadges = {};
+  app.post("/deleteRecords", deleteRecordsRoute(db));
 
-    async function checkAndGetNotificationBadge(obj) {
-      if (obj.notificationBadge) {
-        const { err, rows } = await db.query(obj.notificationBadge.query);
-        if (err) {
-          console.error(err);
-        } else if (
-          rows.length > 0 &&
-          rows[0][obj.notificationBadge.attribute]
-        ) {
-          const notificationBadge = rows[0][obj.notificationBadge.attribute];
-          if (
-            !obj.notificationBadge.displayCondition ||
-            obj.notificationBadge.displayCondition(notificationBadge)
-          ) {
-            notificationBadges[obj.__id__] = notificationBadge;
-          }
-        }
-      }
-    }
+  app.get("/notificationBadges", notificationBadgesRoute(db));
 
-    for (const view of req.config.views) {
-      await checkAndGetNotificationBadge(view);
-      if (view.subviews) {
-        for (const subview of view.subviews) {
-          await checkAndGetNotificationBadge(subview);
-        }
-      }
-    }
-    res.send(notificationBadges);
-  });
+  app.post("/duplicateRecord", duplicateRecordRoute(db));
 
-  app.post("/duplicateRecord", async function (req, res, next) {
-    // SECURITY: bound the (client-supplied) target table to tables the role may write.
-    const allowedTables = writableTables(req);
-    const requestedTables = [
-      req.body.table,
-      ...(req.body.duplicateConfig?.foreignTables || []).map((t) => t.table),
-    ];
-    if (requestedTables.some((t) => !allowedTables.has(t))) {
-      return res.sendStatus(403);
-    }
-    const primaryId = req.body.duplicateConfig.primaryId;
-    const { err, rows } = await db.query("SELECT * FROM ?? WHERE ?? = ?", [
-      req.body.table,
-      primaryId,
-      req.body.primaryValue,
-    ]);
-    if (err) {
-      return res.status(500).send(err);
-    }
-    const record = rows[0];
-    const data = {};
-    for (let field of req.body.duplicateConfig.fields) {
-      data[field] = record[field];
-    }
-    const { err: err2, rows: r } = await db.query(
-      "INSERT IGNORE INTO ?? SET ?",
-      [req.body.table, data],
-    );
-    if (err2) {
-      return res.status(500).send(err);
-    }
-    const newRecordId = r.insertId;
-    for (let foreignTable of req.body.duplicateConfig.foreignTables) {
-      const { err, rows } = await db.query("SELECT * FROM ?? WHERE ?? = ?", [
-        foreignTable.table,
-        primaryId,
-        req.body.primaryValue,
-      ]);
-      if (err) console.log(err);
-      for (let record of rows) {
-        const data = {};
-        data[primaryId] = newRecordId;
-        for (let field of foreignTable.fields) {
-          data[field] = record[field];
-        }
-        await db.query("INSERT IGNORE INTO ?? SET ?", [
-          foreignTable.table,
-          data,
-        ]);
-      }
-    }
-    res.sendStatus(200);
-  });
-
-  app.post("/createRecord", async function (req, res, next) {
-    const view = req.config.views[req.body.viewIndex];
-    // panelIndex arrives as a string from the front-end but a numeric caller
-    // may send 0 — only null/undefined mean "no panel".
-    const hasPanel =
-      req.body.panelIndex !== undefined && req.body.panelIndex !== null;
-    const panel = hasPanel ? view.recordViewPanels[req.body.panelIndex] : null;
-    if (!hasPanel && touchesHiddenColumn(view, req.body.data)) {
-      return res.sendStatus(403);
-    }
-    try {
-      for (let key in req.body.data) {
-        if (
-          req.body.data[key] == "NULL" ||
-          req.body.data[key] === "Invalid date"
-        ) {
-          req.body.data[key] = null;
-        }
-      }
-      if (panel) {
-        req.body.data[panel.createConfig.recordIdKey] = req.body.recordId;
-      }
-      const primaryColumn = (view || panel)?.columns?.find(
-        (x) => x.name === (view || panel).primaryId,
-      );
-      if (primaryColumn?.dataType == "uuid") {
-        req.body.data[primaryColumn.name] = uuidv4();
-      }
-      const createPayload = JSON.parse(JSON.stringify(req.body.data));
-      const columns = panel ? panel.createConfig.columns : view.columns;
-      for (let key in createPayload) {
-        if (
-          columns?.find((x) => x.name === key)?.includedInCreatePayload ===
-          false
-        ) {
-          delete createPayload[key];
-        }
-      }
-      if (!areSafeColumnNames(createPayload)) {
-        return res.status(400).send({ error: "Invalid column name" });
-      }
-      const queryExpression = Object.keys(createPayload)
-        .map((x) => quoteIdentifier(x, db.dbType))
-        .join(", ");
-      const queryPlaceholders = Object.keys(createPayload)
-        .map((x) => "?")
-        .join(", ");
-      const queryParameters = Object.keys(createPayload).map(
-        (x) => createPayload[x],
-      );
-      const { err, rows: r } = await db.query(
-        `INSERT INTO ?? (${queryExpression}) VALUES(${queryPlaceholders})`,
-        [panel ? panel.tableName : view.tableName, ...queryParameters],
-      );
-      if (err) {
-        console.error(err);
-        return res.status(500).send({
-          err,
-          message:
-            err.code === "ER_DUP_ENTRY"
-              ? "Cet élément existe déjà."
-              : "Une erreur est survenue.",
-        });
-      }
-      if (panel ? panel.createCallback : view.createCallback) {
-        try {
-          await axios.post(panel ? panel.createCallback : view.createCallback, {
-            id: r.insertId,
-            data: req.body.data,
-          });
-        } catch (e) {}
-      }
-      if (panel ? panel.createCallbackFunction : view.createCallbackFunction) {
-        // The insert is already committed: a failing callback must not turn
-        // into a 500 that invites a client retry (which would duplicate the
-        // row). Log and answer 200.
-        try {
-          await (
-            panel ? panel.createCallbackFunction : view.createCallbackFunction
-          )({
-            id: r.insertId,
-            data: req.body.data,
-          });
-        } catch (callbackErr) {
-          console.error(callbackErr);
-        }
-      }
-      res.send({
-        id: r.insertId,
-      });
-    } catch (err) {
-      console.error(err);
-      res.status(500).send({
-        err,
-        message: "Une erreur est survenue.",
-      });
-    }
-  });
+  app.post("/createRecord", createRecordRoute(db));
 
   // Attack-surface reduction: only expose /customQuery at all when the config
   // actually declares SQL templates (panels, autocomplete lists, …). If nothing
@@ -1278,421 +196,17 @@ export default (db, config) => {
   if (!CONFIG_USES_CUSTOM_QUERY) {
     app.get("/customQuery", (req, res) => res.sendStatus(404));
   } else {
-    app.get("/customQuery", async function (req, res, next) {
-      const template =
-        typeof req.query.query === "string" ? req.query.query : "";
-      // SECURITY: only run whitelisted, read-only templates, and bind the record id
-      // as a parameter instead of substituting it into the SQL string.
-      const allowed = collectAllowedQueries(req.config.views);
-      if (!allowed.has(template.trim())) {
-        return res.status(403).send({ error: "Query not allowed" });
-      }
-      if (!/^\s*\(?\s*(select|with)\b/i.test(template) || /;/.test(template)) {
-        return res
-          .status(400)
-          .send({ error: "Only read-only queries are allowed" });
-      }
-      const placeholderCount = (template.match(/\?/g) || []).length;
-      const params = new Array(placeholderCount).fill(req.query.primaryValue);
-      const { err, rows } = await db.query(template, params);
-      if (err) {
-        return res.status(500).send(err);
-      }
-      if (req.query.viewIndex && req.query.panelIndex) {
-        const panel =
-          req.config.views[req.query.viewIndex as string].recordViewPanels[
-            req.query.panelIndex as string
-          ];
-        if (panel.formatValue) {
-          for (const row of rows) {
-            for (const key in panel.formatValue) {
-              row[key] = await panel.formatValue[key](row);
-            }
-          }
-        }
-      }
-      res.send(rows);
-    });
-  }
-
-  function uploadFile(column, fileParamName, req, res) {
-    if (column.s3Config || column.gcpConfig) {
-      const form = new multiparty.Form();
-      form.parse(req, async function (err, fields, files) {
-        if (err) {
-          return res.status(500).send(err);
-        }
-        const originalFilename = files[fileParamName][0].originalFilename;
-        const contentType =
-          mime.getType(originalFilename) || "application/octet-stream";
-
-        const extension = originalFilename.match(/(?:\.([^.]+))?$/)[1];
-        let aspectRatio = null;
-        if (["png", "jpeg", "jpg", "gif"].includes(extension)) {
-          try {
-            const dimensions = await getImageDimensions(
-              files[fileParamName][0].path,
-            );
-            if (dimensions) {
-              aspectRatio = dimensions.height / dimensions.width;
-            }
-          } catch {
-            // malformed image data: leave aspectRatio null rather than crash
-          }
-        }
-        const originalFilenameWithoutExtension = originalFilename.replace(
-          "." + extension,
-          "",
-        );
-
-        if (column.gcpConfig) {
-          const gcpConfig = column.gcpConfig;
-          const path =
-            (gcpConfig.subfolder ? gcpConfig.subfolder + "/" : "") +
-            originalFilenameWithoutExtension +
-            "-" +
-            Math.random().toString().substr(2) +
-            "." +
-            extension;
-          const storage = new Storage();
-
-          const bucketName = gcpConfig.bucket;
-          storage
-            .bucket(bucketName)
-            .upload(files[fileParamName][0].path, {
-              destination: path,
-            })
-            .then(() => {
-              res.status(200).send({
-                path: gcpConfig.pathTransform
-                  ? gcpConfig.pathTransform(path)
-                  : path,
-                aspectRatio,
-                originalFilename,
-              });
-            })
-            .catch((e) => {
-              res.status(500).send(e);
-            });
-        } else {
-          const s3Config = column.s3Config;
-          const path =
-            (s3Config.subfolder ? s3Config.subfolder + "/" : "") +
-            originalFilenameWithoutExtension +
-            "-" +
-            Math.random().toString().substr(2) +
-            "." +
-            extension;
-          const rawHost = String(s3Config.host || "");
-          const endpoint = /^https?:\/\//i.test(rawHost)
-            ? rawHost
-            : `https://${rawHost}`;
-          const s3 = new S3Client({
-            endpoint,
-            region: s3Config.region,
-            ...(s3Config.accessKeyId && {
-              credentials: {
-                accessKeyId: s3Config.accessKeyId,
-                secretAccessKey: s3Config.secretAccessKey ?? "",
-              },
-            }),
-            forcePathStyle: false,
-          });
-          if (s3Config.signedUrlNeeded) {
-            getSignedUrl(
-              s3,
-              new PutObjectCommand({
-                Bucket: s3Config.bucket,
-                Key: path,
-                ContentType: contentType,
-              }),
-              { expiresIn: 150 },
-            )
-              .then((signedUrl) =>
-                axios.put(
-                  signedUrl,
-                  fs.readFileSync(files[fileParamName][0].path),
-                  {
-                    maxContentLength: 100000000000,
-                    maxBodyLength: 100000000000,
-                    headers: {
-                      "Content-Type": contentType,
-                    },
-                  },
-                ),
-              )
-              .then(() => {
-                res.status(200).send({
-                  path: s3Config.pathTransform
-                    ? s3Config.pathTransform(path)
-                    : path,
-                  aspectRatio,
-                  originalFilename,
-                });
-              })
-              .catch((e) => {
-                res.status(500).send(e);
-              });
-          } else {
-            s3.send(
-              new PutObjectCommand({
-                Body: fs.readFileSync(files[fileParamName][0].path),
-                Bucket: s3Config.bucket,
-                ContentType: contentType,
-                ACL: "public-read",
-                Key: path,
-              }),
-            )
-              .then(() => {
-                res.send({
-                  url: `https://${s3Config.host}/${s3Config.bucket}/${path}`,
-                  path: s3Config.pathTransform
-                    ? s3Config.pathTransform(path)
-                    : path,
-                  aspectRatio,
-                  originalFilename,
-                });
-              })
-              .catch((err) => res.status(500).send(err));
-          }
-        }
-      });
-    } else if (column.sftpConfig) {
-      if (!column.publicPath) {
-        return res
-          .status(500)
-          .send("You need to pass publicPath parameter when using sftpConfig");
-      }
-      const form = new multiparty.Form();
-      form.parse(req, function (err, fields, files) {
-        if (err) {
-          return res.status(500).send(err);
-        }
-        const pathSplitted = files[fileParamName][0].path.split(/[\/\\]+/);
-        const filename = pathSplitted[pathSplitted.length - 1];
-        (async () => {
-          const sftp = new SftpClient();
-          await sftp.connect({
-            host: column.sftpConfig.host,
-            port: 22,
-            username: column.sftpConfig.user,
-            password: column.sftpConfig.password,
-          });
-          await sftp.fastPut(
-            files[fileParamName][0].path,
-            column.publicPath +
-              (column.subdirectory ? "/" + column.subdirectory : "") +
-              "/" +
-              filename,
-          );
-          await sftp.end();
-          res.send({
-            path: filename,
-            originalFilename: files[fileParamName][0].originalFilename,
-          });
-          fs.unlinkSync(files[fileParamName][0].path);
-        })();
-      });
-    } else {
-      const form = new multiparty.Form({
-        uploadDir:
-          (column.publicPath as string) + (column.subdirectory as string),
-      });
-      form.parse(req, function (err, fields, files) {
-        if (err) {
-          return res.status(500).send(err);
-        }
-        res.send({
-          path: files[fileParamName][0].path.replace(column.publicPath, ""),
-          originalFilename: files[fileParamName][0].originalFilename,
-        });
-      });
-    }
+    app.get("/customQuery", customQueryRoute(db));
   }
 
   app.post(
     "/uploadFileFromBetterRichTextInput",
-    async function (req, res, next) {
-      // Resolve settings on the server so function-valued pathTransform survives.
-      // Validate the target before parsing multipart data or contacting storage.
-      const role = roleOf(req);
-      const { viewIndex, columnId } = req.query;
-      if (
-        typeof viewIndex !== "string" ||
-        !/^\d+$/.test(viewIndex) ||
-        typeof columnId !== "string"
-      ) {
-        return res.sendStatus(403);
-      }
-      const view = req.config.views[viewIndex];
-      if (!view || !canWriteView(view, role)) {
-        return res.sendStatus(403);
-      }
-      const column = [
-        ...(view.columns || []),
-        ...(view.recordViewPanels?.flatMap(
-          (panel) => panel.createConfig?.columns || [],
-        ) || []),
-      ].find((column) => column.__id__ === columnId);
-      if (!column || (column.roles && !column.roles.includes(role))) {
-        return res.sendStatus(403);
-      }
-      if (column.dataType !== "betterRichText" || !column.fileUploadProperties) {
-        return res.status(400).send({ error: "Invalid rich-text upload column" });
-      }
-      uploadFile(column.fileUploadProperties, "upload", req, res);
-    },
+    uploadFileFromBetterRichTextInputRoute(),
   );
 
-  app.post("/uploadFile", async function (req, res, next) {
-    const view = req.config.views[req.query.viewIndex as string];
-    const column = [
-      ...view.columns,
-      ...(view.recordViewPanels
-        ?.map((x) => x?.createConfig?.columns)
-        ?.filter((x) => x)
-        ?.flat() || []),
-    ].find((x) => x.__id__ == req.query.columnId);
-    uploadFile(column, "file", req, res);
-  });
+  app.post("/uploadFile", uploadFileRoute());
 
-  app.get("/searchCompanies", async (req, res) => {
-    const processedQuery = (req.query.query as any).replaceAll(" ", "-");
-    try {
-      const response = await axios.get(
-        `https://public.opendatasoft.com/api/explore/v2.1/catalog/datasets/economicref-france-sirene-v3/records`,
-        {
-          params: {
-            where: `denominationunitelegale LIKE '${processedQuery}*' OR siret LIKE '${processedQuery}*'`,
-            limit: 100,
-          },
-        },
-      );
-      const results = response.data.results
-        .filter(
-          (etablissement) =>
-            etablissement.etatadministratifetablissement === "Actif",
-        )
-        .map((etablissement) => ({
-          id: Math.random().toString().slice(2),
-          companyName: etablissement.denominationunitelegale,
-          siret: etablissement.siret,
-          siren: etablissement.siren,
-          address: `${etablissement.numerovoieetablissement || ""} ${etablissement.typevoieetablissement || ""} ${etablissement.libellevoieetablissement || ""}`,
-          city: etablissement.libellecommuneetablissement,
-          zipCode: etablissement.codepostaletablissement,
-          activityNumber: etablissement.activiteprincipaleunitelegale,
-        }))
-        .slice(0, 30);
-      res.send(results);
-    } catch (e) {
-      res.send([]);
-    }
-  });
+  app.get("/searchCompanies", searchCompaniesRoute());
 
   return app;
 };
-
-// Collect every SQL template declared anywhere in the (role-filtered) config:
-// panel `query`, `autocompleteListQuery`, etc. customQuery may only run a
-// template that already exists in the config the caller is allowed to see —
-// so it can never be turned into an arbitrary read/write primitive.
-export function collectAllowedQueries(node, acc = new Set<string>()) {
-  if (!node || typeof node !== "object") return acc;
-  if (Array.isArray(node)) {
-    for (const item of node) collectAllowedQueries(item, acc);
-    return acc;
-  }
-  for (const key of Object.keys(node)) {
-    const value = node[key];
-    if (typeof value === "string" && (key === "query" || /Query$/.test(key))) {
-      acc.add(value.trim());
-    } else if (value && typeof value === "object") {
-      collectAllowedQueries(value, acc);
-    }
-  }
-  return acc;
-}
-
-export async function enrichConfig(config, db) {
-  const { rows: info, err } = await db.query(
-    "SELECT * FROM information_schema.columns WHERE table_schema = ?",
-    [config.mysql?.database || config.postgresql?.database],
-  );
-  if (err) {
-    console.error(err);
-    return;
-  }
-  for (const view of config.views) {
-    if (view.type == "table") {
-      const tableName = view.tableName;
-      for (const infoEl of info) {
-        if (infoEl.TABLE_NAME == tableName && infoEl.COLUMN_KEY == "PRI") {
-          view.primaryId = infoEl.COLUMN_NAME;
-        }
-      }
-      for (const column of view.columns) {
-        enrichColumn(column, tableName, info);
-      }
-      if (view.recordViewPanels) {
-        for (const panel of view.recordViewPanels) {
-          if (panel.createConfig) {
-            for (const column of panel.createConfig.columns) {
-              enrichColumn(column, tableName, info);
-            }
-          }
-          if (!panel.__id__) {
-            panel.__id__ = generateUniqueIdForObject(panel);
-          }
-        }
-      }
-    }
-    if (view.subviews) {
-      for (const subview of view.subviews) {
-        if (!subview.__id__) {
-          subview.__id__ = generateUniqueIdForObject(subview);
-        }
-      }
-    }
-    if (!view.__id__) {
-      view.__id__ = generateUniqueIdForObject(view);
-    }
-  }
-  config.enriched = true;
-}
-
-export function enrichColumn(column, tableName, info) {
-  if (!column.__id__) {
-    column.__id__ = generateUniqueIdForObject(column);
-  }
-  const infoEl = info.find(
-    (x) => x.TABLE_NAME == tableName && x.COLUMN_NAME == column.name,
-  );
-  if (
-    infoEl?.IS_NULLABLE == "NO" &&
-    infoEl?.DATA_TYPE != "text" &&
-    column.required !== true &&
-    column.required !== false
-  ) {
-    column.required = true;
-  }
-  if (!column.dataType && infoEl) {
-    column.dataType = infoEl.DATA_TYPE;
-    if (column.dataType == "enum") {
-      column.dataType = "select";
-      column.options = JSON.parse(
-        infoEl.COLUMN_TYPE.replace("enum(", "[")
-          .replace(")", "]")
-          .replace(/'/g, '"'),
-      );
-    }
-  }
-  if (column.dataType == "richText") {
-    column.name = column.contentField;
-  }
-  if (column.dataType == "file" && (column.s3Config || column.gcpConfig)) {
-    const host = column.s3Config?.host || column.gcpConfig?.host;
-    const bucket = column.s3Config?.bucket || column.gcpConfig?.bucket;
-    column.baseUrl = `https://${host}/${bucket}/`;
-  }
-}