@galadrim/galadmin 0.2.7 → 0.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galadrim/galadmin",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "main": "dist/index.js",
   "scripts": {
     "test": "jest",

package/src/api.ts

@@ -209,6 +209,21 @@ declare global {
   }
 }
 
+// Columns of `view` the current role may not see (cf. the config middleware below).
+export const hiddenColumnsOf = (view) => (view && view.__hiddenColumns) || [];
+
+// Removes the hidden columns from a record before it is sent.
+export const stripHiddenColumns = (view, record) => {
+  for (const name of hiddenColumnsOf(view)) delete record[name];
+  return record;
+};
+
+// Whether a write payload touches a hidden column.
+export const touchesHiddenColumn = (view, data) =>
+  hiddenColumnsOf(view).some(
+    (name) => data && Object.prototype.hasOwnProperty.call(data, name),
+  );
+
 export default (db, config) => {
   const app = express();
 
@@ -243,14 +258,19 @@ export default (db, config) => {
         })
         .map((view) => {
           if (view.type === "table") {
+            const allowed = (column) =>
+              !column.roles ||
+              (req.session.user &&
+                column.roles.includes(req.session.user.role));
             return {
               ...view,
-              columns: view.columns.filter(
-                (column) =>
-                  !column.roles ||
-                  (req.session.user &&
-                    column.roles.includes(req.session.user.role)),
-              ),
+              columns: view.columns.filter(allowed),
+              // SECURITY: a column's `roles` must hold server-side too. Rows are read with SELECT *, and
+              // writes take any column sent: the names of the columns this role may not see are kept
+              // here, stripped from every record sent back and refused in every write.
+              __hiddenColumns: view.columns
+                .filter((column) => !allowed(column))
+                .map((column) => column.name),
             };
           } else {
             return view;
@@ -564,6 +584,7 @@ export default (db, config) => {
         }
       }
     }
+    for (const record of records) stripHiddenColumns(view, record);
     res.send({
       records,
       input,
@@ -678,6 +699,9 @@ export default (db, config) => {
             }
           }
         }
+        if (columns.some((name) => hiddenColumnsOf(view).includes(name))) {
+          return res.sendStatus(403);
+        }
 
         let queryString;
         if (db.dbType === "POSTGRESQL") {
@@ -861,7 +885,7 @@ export default (db, config) => {
             await column.formatValue(record);
         }
       }
-      res.send(record);
+      res.send(stripHiddenColumns(view, record));
     } else {
       res.sendStatus(404);
     }
@@ -872,6 +896,9 @@ export default (db, config) => {
     if (!areSafeColumnNames(req.body.data)) {
       return res.status(400).send({ error: "Invalid column name" });
     }
+    if (touchesHiddenColumn(view, req.body.data)) {
+      return res.sendStatus(403);
+    }
     for (let key in req.body.data) {
       if (
         req.body.data[key] == "NULL" ||
@@ -1150,6 +1177,9 @@ export default (db, config) => {
     const hasPanel =
       req.body.panelIndex !== undefined && req.body.panelIndex !== null;
     const panel = hasPanel ? view.recordViewPanels[req.body.panelIndex] : null;
+    if (!hasPanel && touchesHiddenColumn(view, req.body.data)) {
+      return res.sendStatus(403);
+    }
     try {
       for (let key in req.body.data) {
         if (

package/tests/column-roles.test.ts

@@ -0,0 +1,86 @@
+import * as request from "supertest";
+import { buildApiApp } from "./helpers/app";
+import { FakeDb } from "./helpers/fakeDb";
+import { baseConfig, fruitSchema, fruitView, schemaRow } from "./helpers/fixtures";
+
+jest.mock("axios");
+
+/**
+ * A column's `roles` must hold on the server, not only in the interface: rows are read with SELECT *, so a
+ * column hidden from a role must be stripped from what is sent back, and refused in writes.
+ */
+describe("column roles enforced server-side", () => {
+  let db: FakeDb;
+  const row = { id: 1, fruitName: "Pomme", acidity: 3, secret: "s3cr3t" };
+  const config = () =>
+    baseConfig({
+      views: [
+        fruitView({
+          roles: ["root", "user"],
+          columns: [
+            { label: "Nom", name: "fruitName" },
+            { label: "Acidité", name: "acidity" },
+            { label: "Secret", name: "secret", roles: ["root"] },
+          ],
+        }),
+      ],
+    });
+
+  beforeEach(() => {
+    db = new FakeDb();
+    db.schemaRows = fruitSchema([schemaRow("fruits", "secret")]);
+  });
+
+  it("GET /api/record leaves the hidden column out for a role that may not see it", async () => {
+    db.queueRows([{ ...row }]);
+    const res = await request(buildApiApp(db, config(), { role: "user", userId: 7 }))
+      .get("/api/record")
+      .query({ viewIndex: 0, recordId: 1 })
+      .expect(200);
+    expect(res.body.fruitName).toBe("Pomme");
+    expect(res.body).not.toHaveProperty("secret");
+  });
+
+  it("GET /api/record keeps it for a role that may see it", async () => {
+    db.queueRows([{ ...row }]);
+    const res = await request(buildApiApp(db, config(), { role: "root", userId: 1 }))
+      .get("/api/record")
+      .query({ viewIndex: 0, recordId: 1 })
+      .expect(200);
+    expect(res.body.secret).toBe("s3cr3t");
+  });
+
+  it("POST /api/records leaves the hidden column out of every record", async () => {
+    db.defaultResult = { err: null, rows: [{ ...row, total: 1, count: 1 }] };
+    const res = await request(buildApiApp(db, config(), { role: "user", userId: 7 }))
+      .post("/api/records")
+      .send({ viewIndex: 0, page: 1, filters: [] })
+      .expect(200);
+    expect(res.body.records.length).toBeGreaterThan(0);
+    for (const record of res.body.records) expect(record).not.toHaveProperty("secret");
+  });
+
+  it("POST /api/updateRecord refuses to write the hidden column", async () => {
+    await request(buildApiApp(db, config(), { role: "user", userId: 7 }))
+      .post("/api/updateRecord")
+      .send({ viewIndex: 0, primaryValue: 1, data: { secret: "x" } })
+      .expect(403);
+    expect(db.dataQueries().length).toBe(0);
+  });
+
+  it("POST /api/updateRecord still writes the visible columns", async () => {
+    db.queueRows({ affectedRows: 1 });
+    await request(buildApiApp(db, config(), { role: "user", userId: 7 }))
+      .post("/api/updateRecord")
+      .send({ viewIndex: 0, primaryValue: 1, data: { fruitName: "Poire" } })
+      .expect((res) => expect(res.status).not.toBe(403));
+  });
+
+  it("POST /api/createRecord refuses to set the hidden column", async () => {
+    await request(buildApiApp(db, config(), { role: "user", userId: 7 }))
+      .post("/api/createRecord")
+      .send({ viewIndex: 0, data: { fruitName: "Kiwi", secret: "x" } })
+      .expect(403);
+    expect(db.dataQueries().length).toBe(0);
+  });
+});