@magda/org-tree 2.0.0-alpha.0 → 2.0.0-alpha.1

package/bin/org-tree/NestedSetModelQueryer.js

@@ -621,14 +621,15 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
   var undefined;
 
   /** Used as the semantic version number. */
-  var VERSION = '4.17.15';
+  var VERSION = '4.17.21';
 
   /** Used as the size to enable large array optimizations. */
   var LARGE_ARRAY_SIZE = 200;
 
   /** Error message constants. */
   var CORE_ERROR_TEXT = 'Unsupported core-js use. Try https://npms.io/search?q=ponyfill.',
-      FUNC_ERROR_TEXT = 'Expected a function';
+      FUNC_ERROR_TEXT = 'Expected a function',
+      INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`';
 
   /** Used to stand-in for `undefined` hash values. */
   var HASH_UNDEFINED = '__lodash_hash_undefined__';
@@ -761,10 +762,11 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
   var reRegExpChar = /[\\^$.*+?()[\]{}|]/g,
       reHasRegExpChar = RegExp(reRegExpChar.source);
 
-  /** Used to match leading and trailing whitespace. */
-  var reTrim = /^\s+|\s+$/g,
-      reTrimStart = /^\s+/,
-      reTrimEnd = /\s+$/;
+  /** Used to match leading whitespace. */
+  var reTrimStart = /^\s+/;
+
+  /** Used to match a single whitespace character. */
+  var reWhitespace = /\s/;
 
   /** Used to match wrap detail comments. */
   var reWrapComment = /\{(?:\n\/\* \[wrapped with .+\] \*\/)?\n?/,
@@ -774,6 +776,18 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
   /** Used to match words composed of alphanumeric characters. */
   var reAsciiWord = /[^\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f]+/g;
 
+  /**
+   * Used to validate the `validate` option in `_.template` variable.
+   *
+   * Forbids characters which could potentially change the meaning of the function argument definition:
+   * - "()," (modification of function parameters)
+   * - "=" (default value)
+   * - "[]{}" (destructuring of function parameters)
+   * - "/" (beginning of a comment)
+   * - whitespace
+   */
+  var reForbiddenIdentifierChars = /[()=,{}\[\]\/\s]/;
+
   /** Used to match backslashes in property paths. */
   var reEscapeChar = /\\(\\)?/g;
 
@@ -1602,6 +1616,19 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
     });
   }
 
+  /**
+   * The base implementation of `_.trim`.
+   *
+   * @private
+   * @param {string} string The string to trim.
+   * @returns {string} Returns the trimmed string.
+   */
+  function baseTrim(string) {
+    return string
+      ? string.slice(0, trimmedEndIndex(string) + 1).replace(reTrimStart, '')
+      : string;
+  }
+
   /**
    * The base implementation of `_.unary` without support for storing metadata.
    *
@@ -1935,6 +1962,21 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
       : asciiToArray(string);
   }
 
+  /**
+   * Used by `_.trim` and `_.trimEnd` to get the index of the last non-whitespace
+   * character of `string`.
+   *
+   * @private
+   * @param {string} string The string to inspect.
+   * @returns {number} Returns the index of the last non-whitespace character.
+   */
+  function trimmedEndIndex(string) {
+    var index = string.length;
+
+    while (index-- && reWhitespace.test(string.charAt(index))) {}
+    return index;
+  }
+
   /**
    * Used by `_.unescape` to convert HTML entities to characters.
    *
@@ -4328,8 +4370,21 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      * @returns {Array} Returns the new sorted array.
      */
     function baseOrderBy(collection, iteratees, orders) {
+      if (iteratees.length) {
+        iteratees = arrayMap(iteratees, function(iteratee) {
+          if (isArray(iteratee)) {
+            return function(value) {
+              return baseGet(value, iteratee.length === 1 ? iteratee[0] : iteratee);
+            }
+          }
+          return iteratee;
+        });
+      } else {
+        iteratees = [identity];
+      }
+
       var index = -1;
-      iteratees = arrayMap(iteratees.length ? iteratees : [identity], baseUnary(getIteratee()));
+      iteratees = arrayMap(iteratees, baseUnary(getIteratee()));
 
       var result = baseMap(collection, function(value, key, collection) {
         var criteria = arrayMap(iteratees, function(iteratee) {
@@ -4586,6 +4641,10 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
         var key = toKey(path[index]),
             newValue = value;
 
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+          return object;
+        }
+
         if (index != lastIndex) {
           var objValue = nested[key];
           newValue = customizer ? customizer(objValue, key, nested) : undefined;
@@ -4738,11 +4797,14 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      *  into `array`.
      */
     function baseSortedIndexBy(array, value, iteratee, retHighest) {
-      value = iteratee(value);
-
       var low = 0,
-          high = array == null ? 0 : array.length,
-          valIsNaN = value !== value,
+          high = array == null ? 0 : array.length;
+      if (high === 0) {
+        return 0;
+      }
+
+      value = iteratee(value);
+      var valIsNaN = value !== value,
           valIsNull = value === null,
           valIsSymbol = isSymbol(value),
           valIsUndefined = value === undefined;
@@ -6227,10 +6289,11 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
       if (arrLength != othLength && !(isPartial && othLength > arrLength)) {
         return false;
       }
-      // Assume cyclic values are equal.
-      var stacked = stack.get(array);
-      if (stacked && stack.get(other)) {
-        return stacked == other;
+      // Check that cyclic values are equal.
+      var arrStacked = stack.get(array);
+      var othStacked = stack.get(other);
+      if (arrStacked && othStacked) {
+        return arrStacked == other && othStacked == array;
       }
       var index = -1,
           result = true,
@@ -6392,10 +6455,11 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
           return false;
         }
       }
-      // Assume cyclic values are equal.
-      var stacked = stack.get(object);
-      if (stacked && stack.get(other)) {
-        return stacked == other;
+      // Check that cyclic values are equal.
+      var objStacked = stack.get(object);
+      var othStacked = stack.get(other);
+      if (objStacked && othStacked) {
+        return objStacked == other && othStacked == object;
       }
       var result = true;
       stack.set(object, other);
@@ -9776,6 +9840,10 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      * // The `_.property` iteratee shorthand.
      * _.filter(users, 'active');
      * // => objects for ['barney']
+     *
+     * // Combining several predicates using `_.overEvery` or `_.overSome`.
+     * _.filter(users, _.overSome([{ 'age': 36 }, ['age', 40]]));
+     * // => objects for ['fred', 'barney']
      */
     function filter(collection, predicate) {
       var func = isArray(collection) ? arrayFilter : baseFilter;
@@ -10525,15 +10593,15 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      * var users = [
      *   { 'user': 'fred',   'age': 48 },
      *   { 'user': 'barney', 'age': 36 },
-     *   { 'user': 'fred',   'age': 40 },
+     *   { 'user': 'fred',   'age': 30 },
      *   { 'user': 'barney', 'age': 34 }
      * ];
      *
      * _.sortBy(users, [function(o) { return o.user; }]);
-     * // => objects for [['barney', 36], ['barney', 34], ['fred', 48], ['fred', 40]]
+     * // => objects for [['barney', 36], ['barney', 34], ['fred', 48], ['fred', 30]]
      *
      * _.sortBy(users, ['user', 'age']);
-     * // => objects for [['barney', 34], ['barney', 36], ['fred', 40], ['fred', 48]]
+     * // => objects for [['barney', 34], ['barney', 36], ['fred', 30], ['fred', 48]]
      */
     var sortBy = baseRest(function(collection, iteratees) {
       if (collection == null) {
@@ -13077,7 +13145,7 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
       if (typeof value != 'string') {
         return value === 0 ? value : +value;
       }
-      value = value.replace(reTrim, '');
+      value = baseTrim(value);
       var isBinary = reIsBinary.test(value);
       return (isBinary || reIsOctal.test(value))
         ? freeParseInt(value.slice(2), isBinary ? 2 : 8)
@@ -15408,11 +15476,11 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
 
       // Use a sourceURL for easier debugging.
       // The sourceURL gets injected into the source that's eval-ed, so be careful
-      // with lookup (in case of e.g. prototype pollution), and strip newlines if any.
-      // A newline wouldn't be a valid sourceURL anyway, and it'd enable code injection.
+      // to normalize all kinds of whitespace, so e.g. newlines (and unicode versions of it) can't sneak in
+      // and escape the comment, thus injecting code that gets evaled.
       var sourceURL = '//# sourceURL=' +
         (hasOwnProperty.call(options, 'sourceURL')
-          ? (options.sourceURL + '').replace(/[\r\n]/g, ' ')
+          ? (options.sourceURL + '').replace(/\s/g, ' ')
           : ('lodash.templateSources[' + (++templateCounter) + ']')
         ) + '\n';
 
@@ -15445,12 +15513,16 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
 
       // If `variable` is not specified wrap a with-statement around the generated
       // code to add the data object to the top of the scope chain.
-      // Like with sourceURL, we take care to not check the option's prototype,
-      // as this configuration is a code injection vector.
       var variable = hasOwnProperty.call(options, 'variable') && options.variable;
       if (!variable) {
         source = 'with (obj) {\n' + source + '\n}\n';
       }
+      // Throw an error if a forbidden character was found in `variable`, to prevent
+      // potential command injection attacks.
+      else if (reForbiddenIdentifierChars.test(variable)) {
+        throw new Error(INVALID_TEMPL_VAR_ERROR_TEXT);
+      }
+
       // Cleanup code by stripping empty strings.
       source = (isEvaluating ? source.replace(reEmptyStringLeading, '') : source)
         .replace(reEmptyStringMiddle, '$1')
@@ -15564,7 +15636,7 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
     function trim(string, chars, guard) {
       string = toString(string);
       if (string && (guard || chars === undefined)) {
-        return string.replace(reTrim, '');
+        return baseTrim(string);
       }
       if (!string || !(chars = baseToString(chars))) {
         return string;
@@ -15599,7 +15671,7 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
     function trimEnd(string, chars, guard) {
       string = toString(string);
       if (string && (guard || chars === undefined)) {
-        return string.replace(reTrimEnd, '');
+        return string.slice(0, trimmedEndIndex(string) + 1);
       }
       if (!string || !(chars = baseToString(chars))) {
         return string;
@@ -16153,6 +16225,9 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      * values against any array or object value, respectively. See `_.isEqual`
      * for a list of supported value comparisons.
      *
+     * **Note:** Multiple values can be checked by combining several matchers
+     * using `_.overSome`
+     *
      * @static
      * @memberOf _
      * @since 3.0.0
@@ -16168,6 +16243,10 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      *
      * _.filter(objects, _.matches({ 'a': 4, 'c': 6 }));
      * // => [{ 'a': 4, 'b': 5, 'c': 6 }]
+     *
+     * // Checking for several possible values
+     * _.filter(objects, _.overSome([_.matches({ 'a': 1 }), _.matches({ 'a': 4 })]));
+     * // => [{ 'a': 1, 'b': 2, 'c': 3 }, { 'a': 4, 'b': 5, 'c': 6 }]
      */
     function matches(source) {
       return baseMatches(baseClone(source, CLONE_DEEP_FLAG));
@@ -16182,6 +16261,9 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      * `srcValue` values against any array or object value, respectively. See
      * `_.isEqual` for a list of supported value comparisons.
      *
+     * **Note:** Multiple values can be checked by combining several matchers
+     * using `_.overSome`
+     *
      * @static
      * @memberOf _
      * @since 3.2.0
@@ -16198,6 +16280,10 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      *
      * _.find(objects, _.matchesProperty('a', 4));
      * // => { 'a': 4, 'b': 5, 'c': 6 }
+     *
+     * // Checking for several possible values
+     * _.filter(objects, _.overSome([_.matchesProperty('a', 1), _.matchesProperty('a', 4)]));
+     * // => [{ 'a': 1, 'b': 2, 'c': 3 }, { 'a': 4, 'b': 5, 'c': 6 }]
      */
     function matchesProperty(path, srcValue) {
       return baseMatchesProperty(path, baseClone(srcValue, CLONE_DEEP_FLAG));
@@ -16421,6 +16507,10 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      * Creates a function that checks if **all** of the `predicates` return
      * truthy when invoked with the arguments it receives.
      *
+     * Following shorthands are possible for providing predicates.
+     * Pass an `Object` and it will be used as an parameter for `_.matches` to create the predicate.
+     * Pass an `Array` of parameters for `_.matchesProperty` and the predicate will be created using them.
+     *
      * @static
      * @memberOf _
      * @since 4.0.0
@@ -16447,6 +16537,10 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      * Creates a function that checks if **any** of the `predicates` return
      * truthy when invoked with the arguments it receives.
      *
+     * Following shorthands are possible for providing predicates.
+     * Pass an `Object` and it will be used as an parameter for `_.matches` to create the predicate.
+     * Pass an `Array` of parameters for `_.matchesProperty` and the predicate will be created using them.
+     *
      * @static
      * @memberOf _
      * @since 4.0.0
@@ -16466,6 +16560,9 @@ function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName =
      *
      * func(NaN);
      * // => false
+     *
+     * var matchesFunc = _.overSome([{ 'a': 1 }, { 'a': 2 }])
+     * var matchesPropertyFunc = _.overSome([['a', 1], ['a', 2]])
      */
     var overSome = createOver(arraySome);
 
@@ -17799,7 +17896,7 @@ exports.escapeIdentifier = escapeIdentifier;
 function getTableColumnName(columnName, tableRef = "", useLowerCaseColumnName = false) {
     const id = [
         tableRef,
-        useLowerCaseColumnName ? columnName.toLowerCase : useLowerCaseColumnName
+        useLowerCaseColumnName ? columnName.toLowerCase() : columnName
     ]
         .filter((item) => item)
         .join(".");
@@ -18046,7 +18143,7 @@ class AuthDecision {
         }
     }
     toSql(config) {
-        return sql_syntax_1.default.joinWithOr(this.toAspectQueryGroups(config.prefixes).map((item) => item.toSql(config)));
+        return sql_syntax_1.default.joinWithOr(this.toAspectQueryGroups(config.prefixes).map((item) => item.toSql(config))).roundBracket();
     }
 }
 exports.default = AuthDecision;
@@ -18378,9 +18475,13 @@ class NestedSetModelQueryer {
      * @returns {Promise<NodeRecord[]>}
      * @memberof NestedSetModelQueryer
      */
-  getNodes(nodesQuery = {}, fields = null, client = null) {
+  getNodes(nodesQuery = {}, fields = null, client = null, authDecision = AuthDecision_1.UnconditionalTrueDecision) {
     return __awaiter(this, void 0, void 0, function* () {
+      const authConditions = authDecision.toSql({
+        prefixes: ["input.authObject.orgUnit"] });
+
       const clauses = [
+      authConditions,
       nodesQuery.name ?
       sql_syntax_1.sqls`"name" = ${nodesQuery.name}` :
       sql_syntax_1.default.empty,
@@ -18421,7 +18522,7 @@ class NestedSetModelQueryer {
   }
   /**
      * Get the root node of the tree
-     * Return null if empty tree
+     * Return null if empty tree or the user has no access to the root node
      *
      * @param {string[]} [fields=null] Selected Fields; If null, use this.defaultSelectFieldList
      * @param {pg.Client} [client=null] Optional pg client; Use supplied client connection for query rather than a random connection from Pool
@@ -18458,7 +18559,7 @@ class NestedSetModelQueryer {
     return __awaiter(this, void 0, void 0, function* () {
       const authConditions = authDecision.toSql({
         prefixes: ["input.authObject.orgUnit"],
-        tableRef: "Children" });
+        tableRef: "children" });
 
       const tbl = SQLUtils_1.escapeIdentifier(this.tableName);
       const conditions = [
@@ -18491,7 +18592,7 @@ class NestedSetModelQueryer {
     return __awaiter(this, void 0, void 0, function* () {
       const authConditions = authDecision.toSql({
         prefixes: ["input.authObject.orgUnit"],
-        tableRef: "Parents" });
+        tableRef: "parents" });
 
       const tbl = SQLUtils_1.escapeIdentifier(this.tableName);
       const conditions = [
@@ -18522,7 +18623,7 @@ class NestedSetModelQueryer {
     return __awaiter(this, void 0, void 0, function* () {
       const authConditions = authDecision.toSql({
         prefixes: ["input.authObject.orgUnit"],
-        tableRef: "Children" });
+        tableRef: "children" });
 
       const tbl = SQLUtils_1.escapeIdentifier(this.tableName);
       const result = yield (client ? client : this.pool).query(...sql_syntax_1.sqls`SELECT ${this.selectFields("Children", fields)} 
@@ -18556,7 +18657,7 @@ class NestedSetModelQueryer {
     return __awaiter(this, void 0, void 0, function* () {
       const authConditions = authDecision.toSql({
         prefixes: ["input.authObject.orgUnit"],
-        tableRef: "Parents" });
+        tableRef: "parents" });
 
       const tbl = SQLUtils_1.escapeIdentifier(this.tableName);
       const result = yield (client ? client : this.pool).query(...sql_syntax_1.sqls`SELECT ${this.selectFields("Parents", fields)} 
@@ -18618,7 +18719,7 @@ class NestedSetModelQueryer {
     return __awaiter(this, void 0, void 0, function* () {
       const authConditions = authDecision.toSql({
         prefixes: ["input.authObject.orgUnit"],
-        tableRef: "Parents" });
+        tableRef: "parents" });
 
       const tbl = SQLUtils_1.escapeIdentifier(this.tableName);
       const result = yield this.pool.query(...sql_syntax_1.sqls`SELECT COUNT(Parents.id) AS level 
@@ -18679,7 +18780,7 @@ class NestedSetModelQueryer {
     return __awaiter(this, void 0, void 0, function* () {
       const authConditions = authDecision.toSql({
         prefixes: ["input.authObject.orgUnit"],
-        tableRef: "Children" });
+        tableRef: "children" });
 
       const tbl = SQLUtils_1.escapeIdentifier(this.tableName);
       const result = yield this.pool.query(...sql_syntax_1.sqls`SELECT ${this.selectFields("Children")}
@@ -18704,7 +18805,7 @@ class NestedSetModelQueryer {
     return __awaiter(this, void 0, void 0, function* () {
       const authConditions = authDecision.toSql({
         prefixes: ["input.authObject.orgUnit"],
-        tableRef: "Children" });
+        tableRef: "children" });
 
       const tbl = SQLUtils_1.escapeIdentifier(this.tableName);
       const result = yield this.pool.query(...sql_syntax_1.sqls`SELECT ${this.selectFields("Children")}
@@ -18720,9 +18821,11 @@ class NestedSetModelQueryer {
   }
   /**
      * Get all nodes on the top to down path between the `higherNode` to the `lowerNode`
-     * Sort from higher level nodes to lower level node
-     * If a path doesn't exist, null will be returned
-     * If you pass a lower node to the `higherNodeId` and a higher node to `lowerNodeId`, null will be returned
+     * Sort from higher level nodes to lower level node.
+     * Result will include `higherNode` and the `lowerNode`.
+     * If `higherNode` and the `lowerNode` is the same node, an array contains the single node will be return.
+     * If a path doesn't exist, empty array (`[]`) will be returned
+     * If you pass a lower node to the `higherNodeId` and a higher node to `lowerNodeId`, empty array will be returned
      *
      * @param {string} higherNodeId
      * @param {string} lowerNodeId
@@ -18730,6 +18833,7 @@ class NestedSetModelQueryer {
      * @memberof NestedSetModelQueryer
      */
   getTopDownPathBetween(higherNodeId, lowerNodeId, authDecision = AuthDecision_1.UnconditionalTrueDecision) {
+    var _a;
     return __awaiter(this, void 0, void 0, function* () {
       const authConditions = authDecision.toSql({
         prefixes: ["input.authObject.orgUnit"],
@@ -18745,9 +18849,12 @@ class NestedSetModelQueryer {
       sql_syntax_1.default.empty :
       sql_syntax_1.sqls` AND ${authConditions}`}
             ORDER BY (t2.right-t2.left) DESC`.toQuery());
-      if (!result || !result.rows || !result.rows.length)
-      return tsmonad_1.Maybe.nothing();
-      return tsmonad_1.Maybe.just(result.rows);
+      if (!((_a = result === null || result === void 0 ? void 0 : result.rows) === null || _a === void 0 ? void 0 : _a.length)) {
+        return [];
+      } else
+      {
+        return result.rows;
+      }
     });
   }
   /**
@@ -19369,10 +19476,13 @@ class AspectQueryValue {
         switch (typeof value) {
             case "number":
                 this.postgresType = sql_syntax_1.sqls `NUMERIC`;
+                break;
             case "boolean":
                 this.postgresType = sql_syntax_1.sqls `BOOL`;
+                break;
             case "string":
                 this.postgresType = sql_syntax_1.sqls `TEXT`;
+                break;
             default:
                 throw new Error("getPostgresValueTypeCastStr: unsupported data type: `${" +
                     typeof value +

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@magda/org-tree",
   "description": "MAGDA Organizational Hierarchy Management Utilities",
-  "version": "2.0.0-alpha.0",
+  "version": "2.0.0-alpha.1",
   "bin": {
     "org-tree": "./bin/org-tree/org-tree.js"
   },
@@ -14,9 +14,9 @@
   "author": "",
   "license": "Apache-2.0",
   "devDependencies": {
-    "@magda/authorization-api": "^2.0.0-alpha.0",
-    "@magda/scripts": "^2.0.0-alpha.0",
-    "@magda/typescript-common": "^2.0.0-alpha.0",
+    "@magda/authorization-api": "^2.0.0-alpha.1",
+    "@magda/scripts": "^2.0.0-alpha.1",
+    "@magda/typescript-common": "^2.0.0-alpha.1",
     "fs-extra": "^2.1.2",
     "webpack": "^4.41.2",
     "webpack-cli": "^3.3.10"