@opengis/admin 0.3.20 → 0.3.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/admin",
-  "version": "0.3.20",
+  "version": "0.3.22",
   "description": "This project Softpro Admin",
   "main": "dist/admin.js",
   "type": "module",

package/server/plugins/hook.js

@@ -119,27 +119,28 @@ export default async function plugin(fastify) {
 
         try {
             const hashes = await rclient.hgetall('cls-insert-hashes').then(obj => Object.keys(obj));
+            const names = await pgClients.client.query(`select array_agg(name) from admin.cls where parent is null`).then(el => el.rows?.[0]?.array_agg || []);
             const qHashes = await Promise.all(cls.filter((el, idx, arr) => arr.map((item) => item.name).indexOf(el.name) === idx).map(async (el) => {
                 const { name, module, type } = el;
                 const loadTemplate = await getTemplate(type, name);
                 const hash = createHash('md5').update(type === 'cls' ? JSON.stringify(loadTemplate) : (loadTemplate?.sql || loadTemplate)).digest('hex');
-                if (type === 'select' && !hashes.includes(hash)) {
+                if (type === 'select' && (!hashes.includes(hash) || !names.includes(name))) {
                     clsQuery.push(`insert into admin.cls(name,type,data,module) values('${name}','sql','${(loadTemplate?.sql || loadTemplate)?.replace(/'/g, "''")}', '${module?.replace(/'/g, "''")}')`);
                     return hash;
-                } else if (type === 'cls' && loadTemplate?.length && !hashes.includes(hash)) {
+                } else if (type === 'cls' && loadTemplate?.length && (!hashes.includes(hash) || !names.includes(name))) {
                     clsQuery.push(`insert into admin.cls(name,type, module) values('${name}','json', '${module?.replace(/'/g, "''")}'); 
                 insert into admin.cls(code,name,parent,icon,data) 
                 select value->>'id',value->>'text','${name}',value->>'icon',value->>'data' 
                 from json_array_elements('${JSON.stringify(loadTemplate).replace(/'/g, "''")}'::json)`);
                     return hash;
                 } else if (hashes.includes(hash)) {
-                    console.log(name, type, 'skip equal hash');
+                    console.log(name, type, names.includes(name) ? 'skip equal hash' : 'insert missing cls');
                 } else {
                     console.log(name, type, 'empty');
                 }
             }));
 
-            const { rowCount = 0 } = await client.query('delete from admin.cls where name = any($1::text[]) or parent = any($1::text[])', [cls.map(el => el.name)]);
+            const { rowCount = 0 } = await client.query('delete from admin.cls where not name = any($1::text[]) and (case when type = \'json\' then parent = any($1::text[]) else parent is null end)', [cls.map(el => el.name)]);
             console.log('admin/hook old cls deleted', rowCount);
             if (clsQuery.filter((el) => el).length) {
                 console.log('admin/hook cls sql start', clsQuery?.length);

package/server/routes/widget/controllers/widget.del.js

@@ -1,3 +1,11 @@
+import { isFileExists } from "@opengis/fastify-file/utils.js";
+
+async function checkAccess(pg, objectid, id) {
+  const { uid, filepath } = await pg.query(`select uid, file_path as filepath from crm.files where entity_id=$1 and file_id=$2`, [objectid, id])
+    .then(el => el.rows?.[0] || {});
+  return { uid, exists: filepath ? await isFileExists(filepath) : null };
+}
+
 /**
  * Дістає CRM дані для vue хешує ідентифікатори, підтягує селекти
  *
@@ -21,21 +29,29 @@ import { pgClients, logChanges } from "@opengis/fastify-table/utils.js";
 
 export default async function widgetDel({
   pg = pgClients.client, params = {}, session = {},
-}) {
+}, reply) {
   const { user = {} } = session.passport || {};
   if (!user.uid) return { error: 'access restricted', status: 403 };
   const { type, objectid, id } = params;
 
   if (!objectid) return { error: 'id required', status: 400 };
 
+  // force delete db entry if file not exists
+  const { exists, uid } = ['file', 'gallery'].includes(type) ? await checkAccess(pg, objectid, id) : null;
+
+  if (exists && !user?.user_type?.includes?.('admin') && uid && user?.uid !== uid) {
+    return reply.status(403).send('access restricted: file exists, not an author');
+  }
+
   const sqls = {
     comment: 'delete from crm.communications where entity_id=$1 and uid=$2 and communication_id=$3',
     checklist: 'delete from crm.checklists where entity_id=$1 and uid=$2 and checklist_id=$3',
-    file: 'update crm.files set file_status=3 where entity_id=$1 and uid=$2 and file_id=$3 returning uploaded_name',
-    gallery: 'update crm.files set file_status=3 where entity_id=$1 and uid=$2 and file_id=$3 returning uploaded_name',
+    file: `update crm.files set file_status=3 where entity_id=$1 and ${!exists || user?.user_type?.includes?.('admin') ? '$2=$2' : 'uid=$2'} and file_id=$3 returning uploaded_name`,
+    gallery: `update crm.files set file_status=3 where entity_id=$1 and ${!exists || user?.user_type?.includes?.('admin') ? '$2=$2' : 'uid=$2'} and file_id=$3 returning uploaded_name`,
   };
   const sql = sqls[type];
-  if (!sql) return { error: 'type not valid', status: 401 };
+  // console.log(sql);
+  if (!sql) return reply.status(400).send('type not valid');
 
   const { rows = [] } = await pg.query(sql, [objectid, user.uid, id]);
   const table = { comment: 'crm.communications', checklist: 'crm.checklists', file: 'crm.files', gallery: 'crm.files' }[type];