@galadrim/galadmin 0.2.8 → 0.2.9

package/examples/rich-text-upload/server.cjs

@@ -0,0 +1,42 @@
+// Run from the repository after building both the backend and frontend.
+const express = require('express');
+const galadmin = require('../../dist').default;
+
+const app = express();
+const port = Number(process.env.PORT || 3001);
+const cdnBase = process.env.UPLOAD_CDN_BASE;
+if (!cdnBase) throw new Error('Set UPLOAD_CDN_BASE to the public base URL for your test bucket.');
+const pathTransform = (key) => `${cdnBase.replace(/\/$/, '')}/${key}`;
+const fileUploadProperties = process.env.GCP_BUCKET
+  ? { gcpConfig: {
+      host: 'storage.googleapis.com', bucket: process.env.GCP_BUCKET,
+      subfolder: 'galadmin-issue-46', pathTransform,
+    } }
+  : { s3Config: {
+      host: process.env.S3_HOST, bucket: process.env.S3_BUCKET,
+      accessKeyId: process.env.S3_ACCESS_KEY_ID,
+      secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
+      region: process.env.S3_REGION || 'eu-west-3',
+      subfolder: 'galadmin-issue-46', pathTransform,
+    } };
+if (!process.env.GCP_BUCKET && ['S3_HOST', 'S3_BUCKET', 'S3_ACCESS_KEY_ID', 'S3_SECRET_ACCESS_KEY'].some((key) => !process.env[key])) {
+  throw new Error('Set GCP_BUCKET or all of S3_HOST, S3_BUCKET, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY.');
+}
+
+app.use('/admin', galadmin({
+  name: 'Rich-text upload test',
+  sessionSecret: 'local-issue-46-only',
+  auth: { username: 'admin', password: 'admin' },
+  postgresql: {
+    host: '127.0.0.1', port: Number(process.env.PGPORT || 5546),
+    user: 'galadmin', password: 'galadmin', database: 'galadmin_local',
+  },
+  views: [{
+    type: 'table', label: 'Articles', tableName: 'articles', canCreate: true,
+    columns: [
+      { label: 'Title', name: 'title' },
+      { label: 'Body', dataType: 'betterRichText', htmlField: 'body', fileUploadProperties },
+    ],
+  }],
+}));
+app.listen(port, '127.0.0.1', () => console.log(`Open http://localhost:${port}/admin/ (admin / admin)`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galadrim/galadmin",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "main": "dist/index.js",
   "scripts": {
     "test": "jest",

package/src/api.ts

@@ -1511,17 +1511,34 @@ export default (db, config) => {
   app.post(
     "/uploadFileFromBetterRichTextInput",
     async function (req, res, next) {
-      // SECURITY: the upload target comes entirely from the client header and
-      // this route carries no viewIndex, so gate it on the caller being able
-      // to write at least one view (read-only roles are rejected outright).
+      // Resolve settings on the server so function-valued pathTransform survives.
+      // Validate the target before parsing multipart data or contacting storage.
       const role = roleOf(req);
-      if (!req.config.views.some((view) => canWriteView(view, role))) {
+      const { viewIndex, columnId } = req.query;
+      if (
+        typeof viewIndex !== "string" ||
+        !/^\d+$/.test(viewIndex) ||
+        typeof columnId !== "string"
+      ) {
         return res.sendStatus(403);
       }
-      const fileUploadProperties = JSON.parse(
-        req.headers["file-upload-properties"] as string,
-      );
-      uploadFile(fileUploadProperties, "upload", req, res);
+      const view = req.config.views[viewIndex];
+      if (!view || !canWriteView(view, role)) {
+        return res.sendStatus(403);
+      }
+      const column = [
+        ...(view.columns || []),
+        ...(view.recordViewPanels?.flatMap(
+          (panel) => panel.createConfig?.columns || [],
+        ) || []),
+      ].find((column) => column.__id__ === columnId);
+      if (!column || (column.roles && !column.roles.includes(role))) {
+        return res.sendStatus(403);
+      }
+      if (column.dataType !== "betterRichText" || !column.fileUploadProperties) {
+        return res.status(400).send({ error: "Invalid rich-text upload column" });
+      }
+      uploadFile(column.fileUploadProperties, "upload", req, res);
     },
   );
 

package/src/front/build/asset-manifest.json

@@ -1,17 +1,17 @@
 {
   "files": {
     "main.css": "/_HOMEPAGE_/static/css/main.eacc50f1.css",
-    "main.js": "/_HOMEPAGE_/static/js/main.70ad8e58.js",
+    "main.js": "/_HOMEPAGE_/static/js/main.64348568.js",
     "static/media/gt-eesti-medium.woff": "/_HOMEPAGE_/static/media/gt-eesti-medium.a48c02fa57e83ab6ddcd.woff",
     "static/media/gt-eesti-regular.woff": "/_HOMEPAGE_/static/media/gt-eesti-regular.304a7ae06ee4a4d5d04a.woff",
     "static/media/logo.png": "/_HOMEPAGE_/static/media/logo.e407b9ca7e302466a07d.png",
     "static/media/cubano.woff": "/_HOMEPAGE_/static/media/cubano.4eaa47ef94222121a371.woff",
     "index.html": "/_HOMEPAGE_/index.html",
     "main.eacc50f1.css.map": "/_HOMEPAGE_/static/css/main.eacc50f1.css.map",
-    "main.70ad8e58.js.map": "/_HOMEPAGE_/static/js/main.70ad8e58.js.map"
+    "main.64348568.js.map": "/_HOMEPAGE_/static/js/main.64348568.js.map"
   },
   "entrypoints": [
     "static/css/main.eacc50f1.css",
-    "static/js/main.70ad8e58.js"
+    "static/js/main.64348568.js"
   ]
 }

package/src/front/build/index.html

@@ -1 +1 @@
-<!doctype html><html lang="fr"><head><script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.22.2/moment.min.js"></script><script src="https://momentjs.com/downloads/moment-timezone-with-data-10-year-range.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.22.2/locale/fr.js"></script><script async="async" defer="defer" src="https://cdnjs.cloudflare.com/ajax/libs/spectrum/1.8.0/spectrum.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/js/datepicker.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/js/i18n/datepicker.fr.min.js"></script><script async="async" defer="defer" src="https://cdnjs.cloudflare.com/ajax/libs/downloadjs/1.4.8/download.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.4.0/Chart.min.js"></script><script async="async" defer="defer" src="https://cdn.jsdelivr.net/npm/sweetalert"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/quill/1.3.6/quill.min.js"></script><script src="https://sdk.amazonaws.com/js/aws-sdk-2.606.0.min.js"></script><script src="https://kit.fontawesome.com/75b28933ed.js" crossorigin="anonymous" async="async" defer="defer"></script><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/css/datepicker.min.css"/><link rel="stylesheet" href="/_HOMEPAGE_/spectrum.css"/><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/quill/1.3.6/quill.snow.min.css"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta charset="utf-8"/><link rel="icon" href="/_HOMEPAGE_/favicon.png"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="manifest" href="/_HOMEPAGE_/manifest.json"/><title>Back-office</title><script defer="defer" src="/_HOMEPAGE_/static/js/main.70ad8e58.js"></script><link href="/_HOMEPAGE_/static/css/main.eacc50f1.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div></body></html>
+<!doctype html><html lang="fr"><head><script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.22.2/moment.min.js"></script><script src="https://momentjs.com/downloads/moment-timezone-with-data-10-year-range.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.22.2/locale/fr.js"></script><script async="async" defer="defer" src="https://cdnjs.cloudflare.com/ajax/libs/spectrum/1.8.0/spectrum.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/js/datepicker.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/js/i18n/datepicker.fr.min.js"></script><script async="async" defer="defer" src="https://cdnjs.cloudflare.com/ajax/libs/downloadjs/1.4.8/download.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.4.0/Chart.min.js"></script><script async="async" defer="defer" src="https://cdn.jsdelivr.net/npm/sweetalert"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/quill/1.3.6/quill.min.js"></script><script src="https://sdk.amazonaws.com/js/aws-sdk-2.606.0.min.js"></script><script src="https://kit.fontawesome.com/75b28933ed.js" crossorigin="anonymous" async="async" defer="defer"></script><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/air-datepicker/2.2.3/css/datepicker.min.css"/><link rel="stylesheet" href="/_HOMEPAGE_/spectrum.css"/><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/quill/1.3.6/quill.snow.min.css"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta charset="utf-8"/><link rel="icon" href="/_HOMEPAGE_/favicon.png"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="manifest" href="/_HOMEPAGE_/manifest.json"/><title>Back-office</title><script defer="defer" src="/_HOMEPAGE_/static/js/main.64348568.js"></script><link href="/_HOMEPAGE_/static/css/main.eacc50f1.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div></body></html>