@opencloning/opencloningdb 1.8.3 → 1.9.0

package/src/common.js

@@ -1,10 +1,13 @@
 import axios from 'axios';
-import { attachAuthInterceptors, setHttpClientUnauthorizedHandler } from '@opencloning/utils/httpClientAuth';
+import { attachAuthInterceptors, setHttpClientTokenGetter, setHttpClientUnauthorizedHandler } from '@opencloning/utils/httpClientAuth';
 
 
 export const baseUrl = `${import.meta.env?.VITE_OPENCLONING_DB_BACKEND || 'http://localhost:8000'}/db`;
 
-export const setUnauthorizedHandler = setHttpClientUnauthorizedHandler;
+export {
+  setHttpClientTokenGetter,
+  setHttpClientUnauthorizedHandler as setUnauthorizedHandler,
+};
 
 export function setWorkspaceHeader(id) {
   openCloningDBHttpClient.defaults.headers.common['X-Workspace-Id'] = id;
@@ -16,6 +19,8 @@ export function clearWorkspaceHeader() {
 
 export const openCloningDBHttpClient = axios.create({
   baseURL: baseUrl,
+  // Every url is appended to baseURL, so requests (and the auth token) only reach the backend
+  allowAbsoluteUrls: false,
   paramsSerializer: (params) => {
     const searchParams = new URLSearchParams();
 

package/src/common.test.js

@@ -4,6 +4,7 @@ import {
   baseUrl,
   clearWorkspaceHeader,
   openCloningDBHttpClient,
+  setHttpClientTokenGetter,
   setUnauthorizedHandler,
   setWorkspaceHeader,
 } from './common';
@@ -13,15 +14,15 @@ const responseFulfilled = openCloningDBHttpClient.interceptors.response.handlers
 const responseRejected = openCloningDBHttpClient.interceptors.response.handlers[0].rejected;
 
 beforeEach(() => {
-  localStorage.clear();
   clearWorkspaceHeader();
   setUnauthorizedHandler(null);
+  setHttpClientTokenGetter(null);
 });
 
 afterEach(() => {
-  localStorage.clear();
   clearWorkspaceHeader();
   setUnauthorizedHandler(null);
+  setHttpClientTokenGetter(null);
 });
 
 describe('common', () => {
@@ -55,20 +56,20 @@ describe('common', () => {
     expect(openCloningDBHttpClient.defaults.paramsSerializer()).toBe('');
   });
 
-  it('adds the bearer token to request headers when present', () => {
-    localStorage.setItem('token', '__TEST_TOKEN__');
+  it('adds the bearer token from the registered token getter', async () => {
+    setHttpClientTokenGetter(() => '__TEST_TOKEN__');
     const config = { headers: {} };
 
-    const result = requestFulfilled(config);
+    const result = await requestFulfilled(config);
 
     expect(result).toBe(config);
     expect(config.headers.Authorization).toBe('Bearer __TEST_TOKEN__');
   });
 
-  it('leaves request headers unchanged when there is no token', () => {
+  it('leaves request headers unchanged when no token getter is set', async () => {
     const config = { headers: {} };
 
-    const result = requestFulfilled(config);
+    const result = await requestFulfilled(config);
 
     expect(result).toBe(config);
     expect(config.headers.Authorization).toBeUndefined();

package/src/endpoints.js

@@ -1,49 +1,56 @@
+import { encodePathSegment as e } from '@opencloning/utils/urlUtils';
+
+// Every interpolated value is encoded to prevent client-side path traversal
+// (e.g. a sample uid like "../workspaces/1/users/5").
 const endpoints = {
   sequences: '/sequences',
-  sequence: (id) => `/sequences/${id}`,
-  sequenceTextFile: (id) => `/sequences/${id}/text_file_sequence`,
-  sequenceChangeAnnotation: (id) => `/sequences/${id}/change_annotation`,
-  sequenceCloningStrategy: (id) => `/sequences/${id}/cloning_strategy`,
-  sequenceChildren: (id) => `/sequences/${id}/children`,
-  sequenceLines: (id) => `/sequences/${id}/lines`,
-  sequenceChangeCircularity: (id) => `/sequences/${id}/change_circularity`,
-  sequencePrimers: (id) => `/sequences/${id}/primers`,
-  sequenceSequencingFiles: (id) => `/sequences/${id}/sequencing_files`,
+  sequence: (id) => `/sequences/${e(id)}`,
+  sequenceTextFile: (id) => `/sequences/${e(id)}/text_file_sequence`,
+  sequenceTextFiles: '/sequences/text_file_sequences',
+  sequenceChangeAnnotation: (id) => `/sequences/${e(id)}/change_annotation`,
+  sequenceCloningStrategy: (id) => `/sequences/${e(id)}/cloning_strategy`,
+  sequenceChildren: (id) => `/sequences/${e(id)}/children`,
+  sequenceLines: (id) => `/sequences/${e(id)}/lines`,
+  sequenceChangeCircularity: (id) => `/sequences/${e(id)}/change_circularity`,
+  sequencePrimers: (id) => `/sequences/${e(id)}/primers`,
+  sequenceSequencingFiles: (id) => `/sequences/${e(id)}/sequencing_files`,
   sequenceSearch: '/sequences/search',
   sequencesValidateUpload: '/sequences/validate-upload',
   sequencesBulk: '/sequences/bulk',
   sequencesCloningStrategyBulkValidate: '/sequences/cloning_strategy/bulk/validate',
   sequencesCloningStrategyBulk: '/sequences/cloning_strategy/bulk',
-  sequencingFileDownload: (id) => `/sequencing_files/${id}/download`,
-  sequenceSequencingFileDelete: (sequenceId, fileId) => `/sequences/${sequenceId}/sequencing_files/${fileId}`,
+  sequencingFileDownload: (id) => `/sequencing_files/${e(id)}/download`,
+  sequenceSequencingFileDelete: (sequenceId, fileId) => `/sequences/${e(sequenceId)}/sequencing_files/${e(fileId)}`,
   postSequence: '/sequences',
   primers: '/primers',
   primersValidateUpload: '/primers/validate-upload',
   primersBulk: '/primers/bulk',
-  primer: (id) => `/primers/${id}`,
-  primerTemplateSequences: (id) => `/primers/${id}/sequences`,
+  primer: (id) => `/primers/${e(id)}`,
+  primerTemplateSequences: (id) => `/primers/${e(id)}/sequences`,
   postPrimer: '/primers',
   lines: '/lines',
-  line: (id) => `/lines/${id}`,
-  lineChildren: (id) => `/lines/${id}/children`,
-  lineTags: (id) => `/lines/${id}/tags`,
-  inputEntityTags: (id) => `/input_entities/${id}/tags`,
+  line: (id) => `/lines/${e(id)}`,
+  lineChildren: (id) => `/lines/${e(id)}/children`,
+  lineTags: (id) => `/lines/${e(id)}/tags`,
+  inputEntityTags: (id) => `/input_entities/${e(id)}/tags`,
   postLine: '/lines',
   linesValidateUpload: '/lines/validate-upload',
   linesBulk: '/lines/bulk',
   tags: '/tags',
   tagPost: '/tags',
-  tagUnlinkLine: (lineId, tagId) => `/lines/${lineId}/tags/${tagId}`,
-  tagUnlinkInputEntity: (inputEntityId, tagId) => `/input_entities/${inputEntityId}/tags/${tagId}`,
+  tagUnlinkLine: (lineId, tagId) => `/lines/${e(lineId)}/tags/${e(tagId)}`,
+  tagUnlinkInputEntity: (inputEntityId, tagId) => `/input_entities/${e(inputEntityId)}/tags/${e(tagId)}`,
   sequenceSamples: '/sequence_samples',
   postSequenceSample: '/sequence_samples',
-  sequenceSample: (uid) => `/sequence_samples/${uid}`,
+  sequenceSample: (uid) => `/sequence_samples/${e(uid)}`,
   authToken: '/auth/token',
   authRegister: '/auth/register',
   authMe: '/auth/me',
   workspaces: '/workspaces',
   postWorkspace: '/workspaces',
-  workspace: (id) => `/workspaces/${id}`,
+  workspace: (id) => `/workspaces/${e(id)}`,
+  workspaceUsers: (id) => `/workspaces/${e(id)}/users`,
+  workspaceUser: (workspaceId, userId) => `/workspaces/${e(workspaceId)}/users/${e(userId)}`,
   templateSequences: '/template_sequences',
   templateSequencesValidateUpload: '/template_sequences/validate-upload',
   templateSequencesBulk: '/template_sequences/bulk',

package/src/endpoints.test.js

@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest';
+
+import endpoints from './endpoints';
+
+describe('endpoints', () => {
+  it('encodes path parameters so they cannot change the request path', () => {
+    expect(endpoints.sequenceSample('../workspaces/1/users/5')).toBe('/sequence_samples/..%2Fworkspaces%2F1%2Fusers%2F5');
+    expect(endpoints.primer('1/../../workspaces/2')).toBe('/primers/1%2F..%2F..%2Fworkspaces%2F2');
+    expect(() => endpoints.sequenceSample('..')).toThrow();
+  });
+
+  it('keeps normal ids unchanged', () => {
+    expect(endpoints.sequence(12)).toBe('/sequences/12');
+    expect(endpoints.sequenceSequencingFileDelete(3, 4)).toBe('/sequences/3/sequencing_files/4');
+    expect(endpoints.sequenceSample('ML-7_a')).toBe('/sequence_samples/ML-7_a');
+  });
+});

package/src/index.js

@@ -1,4 +1,9 @@
 export { default as OpenCloningDBInterface } from './OpenCloningDBInterface.js';
-export { openCloningDBHttpClient, setUnauthorizedHandler, setWorkspaceHeader, clearWorkspaceHeader, baseUrl, formatSequenceName } from './common.js';
+export { openCloningDBHttpClient, setUnauthorizedHandler, setHttpClientTokenGetter, setWorkspaceHeader, clearWorkspaceHeader, baseUrl, formatSequenceName } from './common.js';
 export { default as endpoints } from './endpoints.js';
 export { default as SequenceSelect } from './SequenceSelect.jsx';
+export { default as TagMultiSelect } from './TagMultiSelect.jsx';
+export { default as SubmitCloningStrategiesInBulkComponent } from './SubmitCloningStrategiesInBulkComponent.jsx';
+export { default as BulkUploadPreview } from './bulk_upload/BulkUploadPreview.jsx';
+export { default as BulkUploadModal } from './bulk_upload/BulkUploadModal.jsx';
+export { CommonTableRow } from './bulk_upload/common.jsx';

package/src/testUtils.test.js

@@ -1,7 +1,7 @@
 import fs from 'fs';
 import { http, HttpResponse } from 'msw';
 import { describe, expect, it } from 'vitest';
-import { baseUrl } from './common';
+import { baseUrl, setHttpClientTokenGetter } from './common';
 
 const STUB_FOLDER = `${__dirname}/../../../OpenCloning_backend/stubs/db`;
 
@@ -75,11 +75,11 @@ export function addStubToServer(server, stub) {
 }
 
 export function setupToken() {
-  localStorage.setItem('token', '__TEST_TOKEN__');
+  setHttpClientTokenGetter(() => '__TEST_TOKEN__');
 }
 
 export function clearToken() {
-  localStorage.removeItem('token');
+  setHttpClientTokenGetter(null);
 }
 
 describe('test utility module', () => {

package/src/useCreateTagMutation.js

@@ -0,0 +1,21 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { openCloningDBHttpClient } from './common';
+import endpoints from './endpoints';
+
+/**
+ * Mutation to create a tag, called with the tag name, resolves to the created tag.
+ * onError receives the error if the creation fails.
+ */
+export default function useCreateTagMutation({ onError } = {}) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (tagName) => {
+      const { data } = await openCloningDBHttpClient.post(endpoints.tagPost, { name: tagName });
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['tags'] });
+    },
+    onError,
+  });
+}