@lowdefy/api 4.7.2 → 5.0.0

package/dist/context/createAuthorize.js

@@ -18,6 +18,11 @@ function createAuthorize({ session }) {
     // else session will be null
     const authenticated = !!session;
     const roles = session?.user?.roles ?? [];
+    if (!Array.isArray(roles)) {
+        throw new ConfigError('session.user.roles must be an array of strings.', {
+            received: roles
+        });
+    }
     function authorize(config) {
         const { auth } = config;
         if (auth.public === true) return true;

package/dist/context/createReadConfigFile.js

@@ -15,8 +15,12 @@
 */ import path from 'path';
 import { cachedPromises, serializer } from '@lowdefy/helpers';
 import { getFileExtension, readFile } from '@lowdefy/node-utils';
+const validPathPattern = /^[A-Za-z0-9\-_/.:]+$/;
 function createReadConfigFile({ buildDirectory, fileCache }) {
     async function readConfigFile(filePath) {
+        if (!validPathPattern.test(filePath) || filePath.includes('..')) {
+            return null;
+        }
         const fileContent = await readFile(path.resolve(buildDirectory, filePath));
         if (getFileExtension(filePath) === 'json') {
             return serializer.deserializeFromString(fileContent);

package/dist/routes/auth/callbacks/createSessionCallback.js

@@ -15,6 +15,7 @@
 */ import crypto from 'crypto';
 import addUserFieldsToSession from './addUserFieldsToSession.js';
 import createCallbackPlugins from './createCallbackPlugins.js';
+import validateSessionRoles from './validateSessionRoles.js';
 function createSessionCallback({ authConfig, plugins }) {
     const sessionCallbackPlugins = createCallbackPlugins({
         authConfig,
@@ -67,6 +68,9 @@ function createSessionCallback({ authConfig, plugins }) {
                 user
             });
         }
+        validateSessionRoles({
+            session
+        });
         // TODO: Should this be session.hashed_id or session.user.hashed_id
         // Only session.user will be available using the _user operator
         session.hashed_id = crypto.createHash('sha256').update(identifier ?? '').digest('base64');

package/dist/routes/auth/callbacks/validateSessionRoles.js

@@ -0,0 +1,33 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ConfigError } from '@lowdefy/errors';
+import { type } from '@lowdefy/helpers';
+function validateSessionRoles({ session }) {
+    const roles = session?.user?.roles;
+    if (type.isNone(roles)) return;
+    if (!Array.isArray(roles)) {
+        throw new ConfigError('session.user.roles must be an array of strings. Check auth.userFields configuration and custom session callback plugins.', {
+            received: roles
+        });
+    }
+    for (const role of roles){
+        if (!type.isString(role)) {
+            throw new ConfigError('session.user.roles must be an array of strings. Check auth.userFields configuration and custom session callback plugins.', {
+                received: roles
+            });
+        }
+    }
+}
+export default validateSessionRoles;

package/dist/routes/rootConfig/getLowdefyTheme.js

@@ -0,0 +1,19 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ async function getLowdefyTheme({ readConfigFile }) {
+    const theme = await readConfigFile('theme.json');
+    return theme || {};
+}
+export default getLowdefyTheme;

package/dist/routes/rootConfig/getRootConfig.js

@@ -14,15 +14,18 @@
   limitations under the License.
 */ import getHomeAndMenus from './getHomeAndMenus.js';
 import getLowdefyGlobal from './getLowdefyGlobal.js';
+import getLowdefyTheme from './getLowdefyTheme.js';
 async function getRootConfig(context) {
-    const [lowdefyGlobal, { home, menus }] = await Promise.all([
+    const [lowdefyGlobal, theme, { home, menus }] = await Promise.all([
         getLowdefyGlobal(context),
+        getLowdefyTheme(context),
         getHomeAndMenus(context)
     ]);
     return {
         home,
         lowdefyGlobal,
-        menus
+        menus,
+        theme
     };
 }
 export default getRootConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/api",
-  "version": "4.7.2",
+  "version": "5.0.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -34,26 +34,26 @@
     "dist/*"
   ],
   "dependencies": {
-    "@lowdefy/ajv": "4.7.2",
-    "@lowdefy/errors": "4.7.2",
-    "@lowdefy/helpers": "4.7.2",
-    "@lowdefy/node-utils": "4.7.2",
-    "@lowdefy/nunjucks": "4.7.2",
-    "@lowdefy/operators": "4.7.2",
-    "@lowdefy/operators-js": "4.7.2"
+    "@lowdefy/ajv": "5.0.0",
+    "@lowdefy/errors": "5.0.0",
+    "@lowdefy/helpers": "5.0.0",
+    "@lowdefy/node-utils": "5.0.0",
+    "@lowdefy/nunjucks": "5.0.0",
+    "@lowdefy/operators": "5.0.0",
+    "@lowdefy/operators-js": "5.0.0"
   },
   "devDependencies": {
     "@jest/globals": "28.1.3",
-    "@swc/cli": "0.1.63",
-    "@swc/core": "1.3.99",
-    "@swc/jest": "0.2.29",
+    "@swc/cli": "0.8.0",
+    "@swc/core": "1.15.18",
+    "@swc/jest": "0.2.39",
     "jest": "28.1.3"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
-    "build": "swc src --out-dir dist --config-file ../../.swcrc --delete-dir-on-start",
+    "build": "swc src --out-dir dist --config-file ../../.swcrc --cli-config-file ../../.swc-cli.json",
     "clean": "rm -rf dist",
     "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
   }