@opencloning/opencloningdb 1.8.2 → 1.8.8

package/CHANGELOG.md

@@ -1,5 +1,76 @@
 # @opencloning/opencloningdb
 
+## 1.8.8
+
+### Patch Changes
+
+- [#778](https://github.com/OpenCloning/OpenCloning_frontend/pull/778) [`fe1d81c`](https://github.com/OpenCloning/OpenCloning_frontend/commit/fe1d81c6f4b85f6317a2a9e46cc68c571c79c394) Thanks [@manulera](https://github.com/manulera)! - Only send the auth token to the backend, and rename the http client APIs.
+
+  - `@opencloning/utils`: `@opencloning/utils/httpClients` exports `getBackendHttpClient(backendUrl, { authenticated })`, a client that can only reach the backend (`allowAbsoluteUrls: false`) and is the only one carrying the auth token, and `getExternalHttpClient()` for whitelisted external urls. Replaces `@opencloning/utils/getHttpClient` (`getHttpClient`, `getAuthenticatedHttpClient`). `attachAuthInterceptors` refuses clients that could send the token elsewhere.
+  - `@opencloning/ui` (breaking): `useHttpClient` is renamed `useBackendHttpClient` and takes urls relative to `backendUrl`; `useBackendRoute` is removed; `useBackendAPI` is renamed `useSourceRequest` and `sendPostRequest` is renamed `sendSourceRequest`.
+  - `@opencloning/opencloningdb`, `@opencloning/opencloning-elabftw`: clients can no longer be pointed at other hosts.
+
+- [#778](https://github.com/OpenCloning/OpenCloning_frontend/pull/778) [`fe1d81c`](https://github.com/OpenCloning/OpenCloning_frontend/commit/fe1d81c6f4b85f6317a2a9e46cc68c571c79c394) Thanks [@manulera](https://github.com/manulera)! - Encode values interpolated into request URL paths to prevent client-side path traversal. A sample UID such as `../workspaces/1/users/5` could make a user's own request hit a different endpoint, e.g. "delete UID" removing a workspace member.
+
+  - `@opencloning/utils`: new `encodePathSegment` (`@opencloning/utils/urlUtils`), which applies `encodeURIComponent` and rejects `.` and `..`.
+  - `@opencloning/opencloningdb`: all path parameters in `endpoints.js` are encoded.
+  - `@opencloning/opencloning-elabftw`: eLabFTW item and upload paths are encoded.
+  - `@opencloning/ui`: the `example`, `key` and `template` URL parameters are encoded when loading examples and templates.
+
+- Updated dependencies [[`fe1d81c`](https://github.com/OpenCloning/OpenCloning_frontend/commit/fe1d81c6f4b85f6317a2a9e46cc68c571c79c394), [`fe1d81c`](https://github.com/OpenCloning/OpenCloning_frontend/commit/fe1d81c6f4b85f6317a2a9e46cc68c571c79c394), [`fe1d81c`](https://github.com/OpenCloning/OpenCloning_frontend/commit/fe1d81c6f4b85f6317a2a9e46cc68c571c79c394)]:
+  - @opencloning/utils@2.0.0
+  - @opencloning/ui@2.0.0
+
+## 1.8.7
+
+### Patch Changes
+
+- Updated dependencies [[`f7f376e`](https://github.com/OpenCloning/OpenCloning_frontend/commit/f7f376ee351d9b2da52413700836dc55ba54b5ea)]:
+  - @opencloning/ui@1.10.0
+  - @opencloning/utils@1.10.0
+
+## 1.8.6
+
+### Patch Changes
+
+- [#771](https://github.com/OpenCloning/OpenCloning_frontend/pull/771) [`73363e7`](https://github.com/OpenCloning/OpenCloning_frontend/commit/73363e7a7f7e494e20a54bd87e5dba97f8a9197e) Thanks [@manulera](https://github.com/manulera)! - Keep OIDC sessions signed in by requesting a token on each API call instead of reusing a stored JWT
+
+- Updated dependencies [[`73363e7`](https://github.com/OpenCloning/OpenCloning_frontend/commit/73363e7a7f7e494e20a54bd87e5dba97f8a9197e)]:
+  - @opencloning/utils@1.9.5
+  - @opencloning/ui@1.9.5
+
+## 1.8.5
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @opencloning/ui@1.9.4
+  - @opencloning/utils@1.9.4
+
+## 1.8.4
+
+### Patch Changes
+
+- [#741](https://github.com/OpenCloning/OpenCloning_frontend/pull/741) [`c65f24a`](https://github.com/OpenCloning/OpenCloning_frontend/commit/c65f24ae853b45005e9a7f429236b8b8d7ea84fa) Thanks [@manulera](https://github.com/manulera)! - Add workspace functionality to add and remove users by owners
+
+- Updated dependencies [[`df69a1b`](https://github.com/OpenCloning/OpenCloning_frontend/commit/df69a1bfb3b3128e93d89eef48a29f81a54ebb82)]:
+  - @opencloning/utils@1.9.3
+  - @opencloning/ui@1.9.3
+
+## 1.8.3
+
+### Patch Changes
+
+- [#732](https://github.com/OpenCloning/OpenCloning_frontend/pull/732) [`cb5ddf4`](https://github.com/OpenCloning/OpenCloning_frontend/commit/cb5ddf4502a288357f8f853242fb35e5ad2a2207) Thanks [@manulera](https://github.com/manulera)! - Create lines from button in list, enables reference strain + transformation + mating
+
+- [#732](https://github.com/OpenCloning/OpenCloning_frontend/pull/732) [`cb5ddf4`](https://github.com/OpenCloning/OpenCloning_frontend/commit/cb5ddf4502a288357f8f853242fb35e5ad2a2207) Thanks [@manulera](https://github.com/manulera)! - Auto-select new tag when creating it
+
+- [#737](https://github.com/OpenCloning/OpenCloning_frontend/pull/737) [`b40f86f`](https://github.com/OpenCloning/OpenCloning_frontend/commit/b40f86fc3219d6016d8d5c8390b171affc8987f8) Thanks [@manulera](https://github.com/manulera)! - Add button for bulk-download to text files
+
+- Updated dependencies [[`06bb1a5`](https://github.com/OpenCloning/OpenCloning_frontend/commit/06bb1a513519f598e9ec3b5eec73544e2ed3958e), [`bc045f9`](https://github.com/OpenCloning/OpenCloning_frontend/commit/bc045f9e74b4d5b84250dcb5a77b93de99e4d684)]:
+  - @opencloning/ui@1.9.2
+  - @opencloning/utils@1.9.2
+
 ## 1.8.2
 
 ### Patch Changes

package/package.json

@@ -1,7 +1,7 @@
 {
   "license": "MIT",
   "name": "@opencloning/opencloningdb",
-  "version": "1.8.2",
+  "version": "1.8.8",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
@@ -15,9 +15,9 @@
   "dependencies": {
     "@mui/icons-material": "^5.18.0",
     "@mui/material": "^5.18.0",
-    "@opencloning/ui": "1.9.1",
-    "@opencloning/utils": "1.9.1",
-    "axios": "^1.16.0"
+    "@opencloning/ui": "2.0.0",
+    "@opencloning/utils": "2.0.0",
+    "axios": "^1.20.0"
   },
   "peerDependencies": {
     "react": "^18.3.1",

package/src/GetSequenceFileAndDatabaseIdComponent.cy.jsx

@@ -29,6 +29,7 @@ describe('<GetSequenceFileAndDatabaseIdComponent />', () => {
     cy.setupOpenCloningDBTestAuth();
 
     cy.interceptOpenCloningDBStub('get_sequences_search_by_name', { alias: 'getSequences' });
+    cy.interceptOpenCloningDBStub('get_sequences_search_by_name_uid_query', { alias: 'getSequencesByNameUidQuery' });
     cy.interceptOpenCloningDBStub('get_text_file_sequence', { alias: 'getSequenceFile' });
 
     cy.mount(
@@ -57,6 +58,7 @@ describe('<GetSequenceFileAndDatabaseIdComponent />', () => {
 
     cy.setupOpenCloningDBTestAuth();
     cy.interceptOpenCloningDBStub('get_sequences_search_by_name', { alias: 'getSequences' });
+    cy.interceptOpenCloningDBStub('get_sequences_search_by_name_uid_query', { alias: 'getSequencesByNameUidQuery' });
 
     cy.getStub('get_text_file_sequence').then((textFileSequenceStub) => {
       let callCount = 0;

package/src/SequenceSelect.cy.jsx

@@ -1,15 +1,18 @@
 import React from 'react';
+import endpoints from './endpoints';
 import SequenceSelect from './SequenceSelect';
 import { clickMultiSelectOption } from '../../../cypress/e2e/common_functions';
 
 const SEQUENCE_NAME = 'ase1_CDS_PCR';
+const SEQUENCE_UID = 'example_sequencing-sample';
 
 describe('<SequenceSelect />', () => {
-  it('searches for a sequence and shows results', () => {
+  it('searches for a sequence by name and shows results', () => {
     cy.setupOpenCloningDBTestAuth();
     const onChangeSpy = cy.spy().as('onChangeSpy');
 
     cy.interceptOpenCloningDBStub('get_sequences_search_by_name', { alias: 'getSequences' });
+    cy.interceptOpenCloningDBStub('get_sequences_search_by_name_uid_query', { alias: 'getSequencesByUid' });
 
     cy.mount(
       <SequenceSelect label="Sequence" onChange={onChangeSpy} multiple={false} />
@@ -29,4 +32,31 @@ describe('<SequenceSelect />', () => {
 
     cy.get('input').should('have.value', SEQUENCE_NAME);
   });
+  it('searches for a sequence by uid and shows results', () => {
+    cy.setupOpenCloningDBTestAuth();
+    const onChangeSpy = cy.spy().as('onChangeSpy');
+
+    cy.interceptOpenCloningDBStub('get_sequences_search_by_uid', { alias: 'getSequencesByUid' });
+    cy.interceptOpenCloningDBStub('get_sequences_search_by_uid_name_query', { alias: 'getSequencesByName' });
+
+
+    cy.mount(
+      <SequenceSelect label="Sequence" onChange={onChangeSpy} multiple={false} />
+    );
+    cy.get('input').click();
+    cy.contains('Type at least').should('exist');
+    cy.get('input').type(SEQUENCE_UID);
+    cy.get('.MuiAutocomplete-listbox li', { timeout: 10000 }).should('have.length.greaterThan', 0);
+
+    // We need to incercept, because it will submit the value of combined name + uid which is not in a stub
+    cy.intercept('GET', Cypress.getDbURL(endpoints.sequences, '*'), { statusCode: 200, body: { items: [] } }).as('getSequences2');
+    clickMultiSelectOption('Sequence', SEQUENCE_UID, 'div');
+
+    cy.getStub('get_sequences_search_by_uid').then((stub) => {
+      const stubSequence = stub.response.body.items.find((sequence) => sequence.sample_uids.includes(SEQUENCE_UID));
+      expect(stubSequence).to.exist;
+      cy.get('@onChangeSpy').should('have.been.calledWith', stubSequence);
+      cy.get('input').should('have.value', `${stubSequence.name} (${SEQUENCE_UID})`);
+    });
+  });
 });

package/src/SequenceSelect.jsx

@@ -1,6 +1,6 @@
 import React from 'react';
 import { QuerySelect, useDebouncedSearchQuery } from '@opencloning/ui';
-import { openCloningDBHttpClient } from './common';
+import { formatSequenceName, openCloningDBHttpClient } from './common';
 import endpoints from './endpoints';
 
 const messages = {
@@ -8,19 +8,25 @@ const messages = {
   errorMessage: 'Could not retrieve sequences from OpenCloningDB',
 };
 
+
 const getGetQuery = (sequenceTypes) => {
-  return (name) => ({
-    queryKey: ['sequences', { sequence_types: sequenceTypes, name }],
+  return (query) => ({
+    queryKey: ['sequences', { sequence_types: sequenceTypes, query }],
     queryFn: async () => {
-      const { data } = await openCloningDBHttpClient.get(endpoints.sequences, {
-        params: { sequence_types: sequenceTypes, name },
-      });
-      return data.items;
+      const results = await Promise.all([
+        openCloningDBHttpClient.get(endpoints.sequences, {
+          params: { sequence_types: sequenceTypes, uid: query },
+        }),
+        openCloningDBHttpClient.get(endpoints.sequences, {
+          params: { sequence_types: sequenceTypes, name: query },
+        }),
+      ]);
+      return [...results[0].data.items, ...results[1].data.items];
     },
   })};
 
 function SequenceSelect({ value, onChange, label, multiple = true, sequenceTypes = undefined, ...rest }) {
-  const { query, autocompleteProps, clearInput } = useDebouncedSearchQuery(getGetQuery(sequenceTypes));
+  const { query, autocompleteProps, clearInput } = useDebouncedSearchQuery(getGetQuery(sequenceTypes), {minChars: 1});
 
   return (
     <QuerySelect
@@ -29,7 +35,7 @@ function SequenceSelect({ value, onChange, label, multiple = true, sequenceTypes
       loadingMessage={messages.loadingMessage}
       errorMessage={messages.errorMessage}
       multiple={multiple}
-      getOptionLabel={(seq) => seq.name ?? `Sequence ${seq.id}`}
+      getOptionLabel={formatSequenceName}
       getOptionKey={(seq) => seq.id}
       value={value}
       onChange={onChange}

package/src/common.js

@@ -1,10 +1,13 @@
 import axios from 'axios';
-import { attachAuthInterceptors, setHttpClientUnauthorizedHandler } from '@opencloning/utils/httpClientAuth';
+import { attachAuthInterceptors, setHttpClientTokenGetter, setHttpClientUnauthorizedHandler } from '@opencloning/utils/httpClientAuth';
 
 
 export const baseUrl = `${import.meta.env?.VITE_OPENCLONING_DB_BACKEND || 'http://localhost:8000'}/db`;
 
-export const setUnauthorizedHandler = setHttpClientUnauthorizedHandler;
+export {
+  setHttpClientTokenGetter,
+  setHttpClientUnauthorizedHandler as setUnauthorizedHandler,
+};
 
 export function setWorkspaceHeader(id) {
   openCloningDBHttpClient.defaults.headers.common['X-Workspace-Id'] = id;
@@ -16,6 +19,8 @@ export function clearWorkspaceHeader() {
 
 export const openCloningDBHttpClient = axios.create({
   baseURL: baseUrl,
+  // Every url is appended to baseURL, so requests (and the auth token) only reach the backend
+  allowAbsoluteUrls: false,
   paramsSerializer: (params) => {
     const searchParams = new URLSearchParams();
 
@@ -40,3 +45,12 @@ export const openCloningDBHttpClient = axios.create({
 });
 
 attachAuthInterceptors(openCloningDBHttpClient);
+
+export function formatSequenceName({ id, name, sample_uids: sampleUids }) {
+  if (!name) return `Sequence ${id}`;
+  let out = name;
+  if (sampleUids && sampleUids.length > 0) {
+    out += ` (${sampleUids.join(', ')})`;
+  }
+  return out;
+}

package/src/common.test.js

@@ -4,6 +4,7 @@ import {
   baseUrl,
   clearWorkspaceHeader,
   openCloningDBHttpClient,
+  setHttpClientTokenGetter,
   setUnauthorizedHandler,
   setWorkspaceHeader,
 } from './common';
@@ -13,15 +14,15 @@ const responseFulfilled = openCloningDBHttpClient.interceptors.response.handlers
 const responseRejected = openCloningDBHttpClient.interceptors.response.handlers[0].rejected;
 
 beforeEach(() => {
-  localStorage.clear();
   clearWorkspaceHeader();
   setUnauthorizedHandler(null);
+  setHttpClientTokenGetter(null);
 });
 
 afterEach(() => {
-  localStorage.clear();
   clearWorkspaceHeader();
   setUnauthorizedHandler(null);
+  setHttpClientTokenGetter(null);
 });
 
 describe('common', () => {
@@ -55,20 +56,20 @@ describe('common', () => {
     expect(openCloningDBHttpClient.defaults.paramsSerializer()).toBe('');
   });
 
-  it('adds the bearer token to request headers when present', () => {
-    localStorage.setItem('token', '__TEST_TOKEN__');
+  it('adds the bearer token from the registered token getter', async () => {
+    setHttpClientTokenGetter(() => '__TEST_TOKEN__');
     const config = { headers: {} };
 
-    const result = requestFulfilled(config);
+    const result = await requestFulfilled(config);
 
     expect(result).toBe(config);
     expect(config.headers.Authorization).toBe('Bearer __TEST_TOKEN__');
   });
 
-  it('leaves request headers unchanged when there is no token', () => {
+  it('leaves request headers unchanged when no token getter is set', async () => {
     const config = { headers: {} };
 
-    const result = requestFulfilled(config);
+    const result = await requestFulfilled(config);
 
     expect(result).toBe(config);
     expect(config.headers.Authorization).toBeUndefined();

package/src/endpoints.js

@@ -1,52 +1,59 @@
+import { encodePathSegment as e } from '@opencloning/utils/urlUtils';
+
+// Every interpolated value is encoded to prevent client-side path traversal
+// (e.g. a sample uid like "../workspaces/1/users/5").
 const endpoints = {
   sequences: '/sequences',
-  sequence: (id) => `/sequences/${id}`,
-  sequenceTextFile: (id) => `/sequences/${id}/text_file_sequence`,
-  sequenceChangeAnnotation: (id) => `/sequences/${id}/change_annotation`,
-  sequenceCloningStrategy: (id) => `/sequences/${id}/cloning_strategy`,
-  sequenceChildren: (id) => `/sequences/${id}/children`,
-  sequenceLines: (id) => `/sequences/${id}/lines`,
-  sequenceChangeCircularity: (id) => `/sequences/${id}/change_circularity`,
-  sequencePrimers: (id) => `/sequences/${id}/primers`,
-  sequenceSequencingFiles: (id) => `/sequences/${id}/sequencing_files`,
+  sequence: (id) => `/sequences/${e(id)}`,
+  sequenceTextFile: (id) => `/sequences/${e(id)}/text_file_sequence`,
+  sequenceChangeAnnotation: (id) => `/sequences/${e(id)}/change_annotation`,
+  sequenceCloningStrategy: (id) => `/sequences/${e(id)}/cloning_strategy`,
+  sequenceChildren: (id) => `/sequences/${e(id)}/children`,
+  sequenceLines: (id) => `/sequences/${e(id)}/lines`,
+  sequenceChangeCircularity: (id) => `/sequences/${e(id)}/change_circularity`,
+  sequencePrimers: (id) => `/sequences/${e(id)}/primers`,
+  sequenceSequencingFiles: (id) => `/sequences/${e(id)}/sequencing_files`,
   sequenceSearch: '/sequences/search',
   sequencesValidateUpload: '/sequences/validate-upload',
   sequencesBulk: '/sequences/bulk',
   sequencesCloningStrategyBulkValidate: '/sequences/cloning_strategy/bulk/validate',
   sequencesCloningStrategyBulk: '/sequences/cloning_strategy/bulk',
-  sequencingFileDownload: (id) => `/sequencing_files/${id}/download`,
-  sequenceSequencingFileDelete: (sequenceId, fileId) => `/sequences/${sequenceId}/sequencing_files/${fileId}`,
+  sequencingFileDownload: (id) => `/sequencing_files/${e(id)}/download`,
+  sequenceSequencingFileDelete: (sequenceId, fileId) => `/sequences/${e(sequenceId)}/sequencing_files/${e(fileId)}`,
   postSequence: '/sequences',
   primers: '/primers',
   primersValidateUpload: '/primers/validate-upload',
   primersBulk: '/primers/bulk',
-  primer: (id) => `/primers/${id}`,
-  primerTemplateSequences: (id) => `/primers/${id}/sequences`,
+  primer: (id) => `/primers/${e(id)}`,
+  primerTemplateSequences: (id) => `/primers/${e(id)}/sequences`,
   postPrimer: '/primers',
   lines: '/lines',
-  line: (id) => `/lines/${id}`,
-  lineChildren: (id) => `/lines/${id}/children`,
-  lineTags: (id) => `/lines/${id}/tags`,
-  inputEntityTags: (id) => `/input_entities/${id}/tags`,
+  line: (id) => `/lines/${e(id)}`,
+  lineChildren: (id) => `/lines/${e(id)}/children`,
+  lineTags: (id) => `/lines/${e(id)}/tags`,
+  inputEntityTags: (id) => `/input_entities/${e(id)}/tags`,
   postLine: '/lines',
   linesValidateUpload: '/lines/validate-upload',
   linesBulk: '/lines/bulk',
   tags: '/tags',
   tagPost: '/tags',
-  tagUnlinkLine: (lineId, tagId) => `/lines/${lineId}/tags/${tagId}`,
-  tagUnlinkInputEntity: (inputEntityId, tagId) => `/input_entities/${inputEntityId}/tags/${tagId}`,
+  tagUnlinkLine: (lineId, tagId) => `/lines/${e(lineId)}/tags/${e(tagId)}`,
+  tagUnlinkInputEntity: (inputEntityId, tagId) => `/input_entities/${e(inputEntityId)}/tags/${e(tagId)}`,
   sequenceSamples: '/sequence_samples',
   postSequenceSample: '/sequence_samples',
-  sequenceSample: (uid) => `/sequence_samples/${uid}`,
+  sequenceSample: (uid) => `/sequence_samples/${e(uid)}`,
   authToken: '/auth/token',
   authRegister: '/auth/register',
   authMe: '/auth/me',
   workspaces: '/workspaces',
   postWorkspace: '/workspaces',
-  workspace: (id) => `/workspaces/${id}`,
+  workspace: (id) => `/workspaces/${e(id)}`,
+  workspaceUsers: (id) => `/workspaces/${e(id)}/users`,
+  workspaceUser: (workspaceId, userId) => `/workspaces/${e(workspaceId)}/users/${e(userId)}`,
   templateSequences: '/template_sequences',
   templateSequencesValidateUpload: '/template_sequences/validate-upload',
   templateSequencesBulk: '/template_sequences/bulk',
+  export: '/export',
 };
 
 export default endpoints;

package/src/endpoints.test.js

@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest';
+
+import endpoints from './endpoints';
+
+describe('endpoints', () => {
+  it('encodes path parameters so they cannot change the request path', () => {
+    expect(endpoints.sequenceSample('../workspaces/1/users/5')).toBe('/sequence_samples/..%2Fworkspaces%2F1%2Fusers%2F5');
+    expect(endpoints.primer('1/../../workspaces/2')).toBe('/primers/1%2F..%2F..%2Fworkspaces%2F2');
+    expect(() => endpoints.sequenceSample('..')).toThrow();
+  });
+
+  it('keeps normal ids unchanged', () => {
+    expect(endpoints.sequence(12)).toBe('/sequences/12');
+    expect(endpoints.sequenceSequencingFileDelete(3, 4)).toBe('/sequences/3/sequencing_files/4');
+    expect(endpoints.sequenceSample('ML-7_a')).toBe('/sequence_samples/ML-7_a');
+  });
+});

package/src/index.js

@@ -1,4 +1,4 @@
 export { default as OpenCloningDBInterface } from './OpenCloningDBInterface.js';
-export { openCloningDBHttpClient, setUnauthorizedHandler, setWorkspaceHeader, clearWorkspaceHeader, baseUrl } from './common.js';
+export { openCloningDBHttpClient, setUnauthorizedHandler, setHttpClientTokenGetter, setWorkspaceHeader, clearWorkspaceHeader, baseUrl, formatSequenceName } from './common.js';
 export { default as endpoints } from './endpoints.js';
 export { default as SequenceSelect } from './SequenceSelect.jsx';

package/src/testUtils.test.js

@@ -1,7 +1,7 @@
 import fs from 'fs';
 import { http, HttpResponse } from 'msw';
 import { describe, expect, it } from 'vitest';
-import { baseUrl } from './common';
+import { baseUrl, setHttpClientTokenGetter } from './common';
 
 const STUB_FOLDER = `${__dirname}/../../../OpenCloning_backend/stubs/db`;
 
@@ -75,11 +75,11 @@ export function addStubToServer(server, stub) {
 }
 
 export function setupToken() {
-  localStorage.setItem('token', '__TEST_TOKEN__');
+  setHttpClientTokenGetter(() => '__TEST_TOKEN__');
 }
 
 export function clearToken() {
-  localStorage.removeItem('token');
+  setHttpClientTokenGetter(null);
 }
 
 describe('test utility module', () => {