@galadrim/galadmin 0.2.7 → 0.2.9

package/examples/rich-text-upload/server.cjs

@@ -0,0 +1,42 @@
+// Run from the repository after building both the backend and frontend.
+const express = require('express');
+const galadmin = require('../../dist').default;
+
+const app = express();
+const port = Number(process.env.PORT || 3001);
+const cdnBase = process.env.UPLOAD_CDN_BASE;
+if (!cdnBase) throw new Error('Set UPLOAD_CDN_BASE to the public base URL for your test bucket.');
+const pathTransform = (key) => `${cdnBase.replace(/\/$/, '')}/${key}`;
+const fileUploadProperties = process.env.GCP_BUCKET
+  ? { gcpConfig: {
+      host: 'storage.googleapis.com', bucket: process.env.GCP_BUCKET,
+      subfolder: 'galadmin-issue-46', pathTransform,
+    } }
+  : { s3Config: {
+      host: process.env.S3_HOST, bucket: process.env.S3_BUCKET,
+      accessKeyId: process.env.S3_ACCESS_KEY_ID,
+      secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
+      region: process.env.S3_REGION || 'eu-west-3',
+      subfolder: 'galadmin-issue-46', pathTransform,
+    } };
+if (!process.env.GCP_BUCKET && ['S3_HOST', 'S3_BUCKET', 'S3_ACCESS_KEY_ID', 'S3_SECRET_ACCESS_KEY'].some((key) => !process.env[key])) {
+  throw new Error('Set GCP_BUCKET or all of S3_HOST, S3_BUCKET, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY.');
+}
+
+app.use('/admin', galadmin({
+  name: 'Rich-text upload test',
+  sessionSecret: 'local-issue-46-only',
+  auth: { username: 'admin', password: 'admin' },
+  postgresql: {
+    host: '127.0.0.1', port: Number(process.env.PGPORT || 5546),
+    user: 'galadmin', password: 'galadmin', database: 'galadmin_local',
+  },
+  views: [{
+    type: 'table', label: 'Articles', tableName: 'articles', canCreate: true,
+    columns: [
+      { label: 'Title', name: 'title' },
+      { label: 'Body', dataType: 'betterRichText', htmlField: 'body', fileUploadProperties },
+    ],
+  }],
+}));
+app.listen(port, '127.0.0.1', () => console.log(`Open http://localhost:${port}/admin/ (admin / admin)`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galadrim/galadmin",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "main": "dist/index.js",
   "scripts": {
     "test": "jest",

package/src/api.ts

@@ -209,6 +209,21 @@ declare global {
   }
 }
 
+// Columns of `view` the current role may not see (cf. the config middleware below).
+export const hiddenColumnsOf = (view) => (view && view.__hiddenColumns) || [];
+
+// Removes the hidden columns from a record before it is sent.
+export const stripHiddenColumns = (view, record) => {
+  for (const name of hiddenColumnsOf(view)) delete record[name];
+  return record;
+};
+
+// Whether a write payload touches a hidden column.
+export const touchesHiddenColumn = (view, data) =>
+  hiddenColumnsOf(view).some(
+    (name) => data && Object.prototype.hasOwnProperty.call(data, name),
+  );
+
 export default (db, config) => {
   const app = express();
 
@@ -243,14 +258,19 @@ export default (db, config) => {
         })
         .map((view) => {
           if (view.type === "table") {
+            const allowed = (column) =>
+              !column.roles ||
+              (req.session.user &&
+                column.roles.includes(req.session.user.role));
             return {
               ...view,
-              columns: view.columns.filter(
-                (column) =>
-                  !column.roles ||
-                  (req.session.user &&
-                    column.roles.includes(req.session.user.role)),
-              ),
+              columns: view.columns.filter(allowed),
+              // SECURITY: a column's `roles` must hold server-side too. Rows are read with SELECT *, and
+              // writes take any column sent: the names of the columns this role may not see are kept
+              // here, stripped from every record sent back and refused in every write.
+              __hiddenColumns: view.columns
+                .filter((column) => !allowed(column))
+                .map((column) => column.name),
             };
           } else {
             return view;
@@ -564,6 +584,7 @@ export default (db, config) => {
         }
       }
     }
+    for (const record of records) stripHiddenColumns(view, record);
     res.send({
       records,
       input,
@@ -678,6 +699,9 @@ export default (db, config) => {
             }
           }
         }
+        if (columns.some((name) => hiddenColumnsOf(view).includes(name))) {
+          return res.sendStatus(403);
+        }
 
         let queryString;
         if (db.dbType === "POSTGRESQL") {
@@ -861,7 +885,7 @@ export default (db, config) => {
             await column.formatValue(record);
         }
       }
-      res.send(record);
+      res.send(stripHiddenColumns(view, record));
     } else {
       res.sendStatus(404);
     }
@@ -872,6 +896,9 @@ export default (db, config) => {
     if (!areSafeColumnNames(req.body.data)) {
       return res.status(400).send({ error: "Invalid column name" });
     }
+    if (touchesHiddenColumn(view, req.body.data)) {
+      return res.sendStatus(403);
+    }
     for (let key in req.body.data) {
       if (
         req.body.data[key] == "NULL" ||
@@ -1150,6 +1177,9 @@ export default (db, config) => {
     const hasPanel =
       req.body.panelIndex !== undefined && req.body.panelIndex !== null;
     const panel = hasPanel ? view.recordViewPanels[req.body.panelIndex] : null;
+    if (!hasPanel && touchesHiddenColumn(view, req.body.data)) {
+      return res.sendStatus(403);
+    }
     try {
       for (let key in req.body.data) {
         if (
@@ -1481,17 +1511,34 @@ export default (db, config) => {
   app.post(
     "/uploadFileFromBetterRichTextInput",
     async function (req, res, next) {
-      // SECURITY: the upload target comes entirely from the client header and
-      // this route carries no viewIndex, so gate it on the caller being able
-      // to write at least one view (read-only roles are rejected outright).
+      // Resolve settings on the server so function-valued pathTransform survives.
+      // Validate the target before parsing multipart data or contacting storage.
       const role = roleOf(req);
-      if (!req.config.views.some((view) => canWriteView(view, role))) {
+      const { viewIndex, columnId } = req.query;
+      if (
+        typeof viewIndex !== "string" ||
+        !/^\d+$/.test(viewIndex) ||
+        typeof columnId !== "string"
+      ) {
         return res.sendStatus(403);
       }
-      const fileUploadProperties = JSON.parse(
-        req.headers["file-upload-properties"] as string,
-      );
-      uploadFile(fileUploadProperties, "upload", req, res);
+      const view = req.config.views[viewIndex];
+      if (!view || !canWriteView(view, role)) {
+        return res.sendStatus(403);
+      }
+      const column = [
+        ...(view.columns || []),
+        ...(view.recordViewPanels?.flatMap(
+          (panel) => panel.createConfig?.columns || [],
+        ) || []),
+      ].find((column) => column.__id__ === columnId);
+      if (!column || (column.roles && !column.roles.includes(role))) {
+        return res.sendStatus(403);
+      }
+      if (column.dataType !== "betterRichText" || !column.fileUploadProperties) {
+        return res.status(400).send({ error: "Invalid rich-text upload column" });
+      }
+      uploadFile(column.fileUploadProperties, "upload", req, res);
     },
   );
 

package/src/front/build/asset-manifest.json

@@ -1,17 +1,17 @@
 {
   "files": {
     "main.css": "/_HOMEPAGE_/static/css/main.eacc50f1.css",
-    "main.js": "/_HOMEPAGE_/static/js/main.70ad8e58.js",
+    "main.js": "/_HOMEPAGE_/static/js/main.64348568.js",
     "static/media/gt-eesti-medium.woff": "/_HOMEPAGE_/static/media/gt-eesti-medium.a48c02fa57e83ab6ddcd.woff",
     "static/media/gt-eesti-regular.woff": "/_HOMEPAGE_/static/media/gt-eesti-regular.304a7ae06ee4a4d5d04a.woff",
     "static/media/logo.png": "/_HOMEPAGE_/static/media/logo.e407b9ca7e302466a07d.png",
     "static/media/cubano.woff": "/_HOMEPAGE_/static/media/cubano.4eaa47ef94222121a371.woff",
     "index.html": "/_HOMEPAGE_/index.html",
     "main.eacc50f1.css.map": "/_HOMEPAGE_/static/css/main.eacc50f1.css.map",
-    "main.70ad8e58.js.map": "/_HOMEPAGE_/static/js/main.70ad8e58.js.map"
+    "main.64348568.js.map": "/_HOMEPAGE_/static/js/main.64348568.js.map"
   },
   "entrypoints": [
     "static/css/main.eacc50f1.css",
-    "static/js/main.70ad8e58.js"
+    "static/js/main.64348568.js"
   ]
 }

package/src/front/build/index.html

@@ -1 +1 @@
-<!doctype html><html lang="fr"><head><script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.22.2/moment.min.js"></script><script src="https://momentjs.com/downloads/moment-timezone-with-data-10-year-range.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.22.2/locale/fr.js"></script><script async="async" defer="defer" src="https://cdnjs.cloudflare.com/ajax/libs/spectrum/1.8.0/spectrum.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/js/datepicker.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/js/i18n/datepicker.fr.min.js"></script><script async="async" defer="defer" src="https://cdnjs.cloudflare.com/ajax/libs/downloadjs/1.4.8/download.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.4.0/Chart.min.js"></script><script async="async" defer="defer" src="https://cdn.jsdelivr.net/npm/sweetalert"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/quill/1.3.6/quill.min.js"></script><script src="https://sdk.amazonaws.com/js/aws-sdk-2.606.0.min.js"></script><script src="https://kit.fontawesome.com/75b28933ed.js" crossorigin="anonymous" async="async" defer="defer"></script><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/css/datepicker.min.css"/><link rel="stylesheet" href="/_HOMEPAGE_/spectrum.css"/><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/quill/1.3.6/quill.snow.min.css"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta charset="utf-8"/><link rel="icon" href="/_HOMEPAGE_/favicon.png"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="manifest" href="/_HOMEPAGE_/manifest.json"/><title>Back-office</title><script defer="defer" src="/_HOMEPAGE_/static/js/main.70ad8e58.js"></script><link href="/_HOMEPAGE_/static/css/main.eacc50f1.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div></body></html>
+<!doctype html><html lang="fr"><head><script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.22.2/moment.min.js"></script><script src="https://momentjs.com/downloads/moment-timezone-with-data-10-year-range.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.22.2/locale/fr.js"></script><script async="async" defer="defer" src="https://cdnjs.cloudflare.com/ajax/libs/spectrum/1.8.0/spectrum.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/js/datepicker.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/js/i18n/datepicker.fr.min.js"></script><script async="async" defer="defer" src="https://cdnjs.cloudflare.com/ajax/libs/downloadjs/1.4.8/download.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.4.0/Chart.min.js"></script><script async="async" defer="defer" src="https://cdn.jsdelivr.net/npm/sweetalert"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/quill/1.3.6/quill.min.js"></script><script src="https://sdk.amazonaws.com/js/aws-sdk-2.606.0.min.js"></script><script src="https://kit.fontawesome.com/75b28933ed.js" crossorigin="anonymous" async="async" defer="defer"></script><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/css/datepicker.min.css"/><link rel="stylesheet" href="/_HOMEPAGE_/spectrum.css"/><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/quill/1.3.6/quill.snow.min.css"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta charset="utf-8"/><link rel="icon" href="/_HOMEPAGE_/favicon.png"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="manifest" href="/_HOMEPAGE_/manifest.json"/><title>Back-office</title><script defer="defer" src="/_HOMEPAGE_/static/js/main.64348568.js"></script><link href="/_HOMEPAGE_/static/css/main.eacc50f1.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div></body></html>