@opengis/cms 0.0.16 → 0.0.18

package/server/routes/cms/controllers/insertContent.js

@@ -1,69 +1,219 @@
-import { config, pgClients, dataInsert } from '@opengis/fastify-table/utils.js';
-
-import builderCache from '../../contentType/utils/builderCache.js';
-
-export default async function insertContent(req, reply) {
-    const {
-        pg = pgClients.client,
-        params = {},
-        user = {},
-        body = {},
-        headers = {},
-    } = req;
-
-    const { type, id = body?.id } = params;
-
-    if (!type) {
-        return reply.status(400).send('not enough params: type');
-    }
-
-    if (builderCache[type]?.table && builderCache[type]?.provider === 'pg' && config.pg) {
-        const { rows = [] } = await dataInsert({
-            pg,
-            id,
-            table: 'site.' + builderCache[type]?.table,
-            data: body,
-            referer: headers?.referer,
-            uid: user?.uid || 0,
-        }).catch(err => {
-            if (err.message?.includes?.('unique constraint')) {
-                return reply.status(400).send('Порушенні унікальності: ' + err.message?.match?.(/([^"]+)/g)?.[1]);
-            }
-            return reply.status(500).send(err.toString());
-        });
-
-        const pk = pg.pk?.['site.' + builderCache[type]?.table];
-        return reply.status(200).send({ id: rows[0]?.[pk], rows });
-    }
-
-    const arr = config.pg ? await pg.query(`select array_agg(relname)::text[] from pg_class a 
-    left join pg_namespace b on a.relnamespace=b.oid 
-    where a.relam=2 and b.nspname='site'`).then(el => el.rows?.[0]?.array_agg || []) : [];
-
-    if (!arr.length) {
-        return reply.status(400).send('empty schema: site');
-    }
-
-    const table = arr.find(el => el === params.type);
-
-    if (!table) {
-        return reply.status(400).send('invalid params: type');
-    }
-
-    const { rows = [] } = await dataInsert({
-        pg,
-        id,
-        table: 'site.' + table,
-        data: body,
-        referer: headers?.referer,
-        uid: user?.uid || 0,
-    }).catch(err => {
-        if (err.message?.includes?.('unique constraint')) {
-            return reply.status(400).send('Порушенні унікальності: ' + err.message?.match?.(/([^"]+)/g)?.[1]);
-        }
-        return reply.status(500).send(err.toString());
-    });
-
-    const pk = pg.pk?.['site.' + table];
-    return reply.status(200).send({ id: rows[0]?.[pk], rows });
+import { config, checkSQL, getTemplate, pgClients, dataInsert, logger } from '@opengis/fastify-table/utils.js';
+import { existsSync, readFileSync } from 'node:fs';
+
+const inputTypes = existsSync('input-types.json') ? JSON.parse(readFileSync('input-types.json') || '{}') : {};
+
+import updateLocalization from '../utils/updateLocalization.js';
+
+const defaultColumns = [
+    'content_id',
+    'space_id',
+    'content_type_id',
+    'created_at',
+    'updated_at',
+    'published_at',
+    'revision',
+    'locale',
+    'status',
+    'slug',
+    'title',
+    'created_by',
+    'published_by',
+    'updated_by',
+    'meta',
+];
+
+export default async function insertContent(req, reply) {
+    const {
+        pg = pgClients.client,
+        params = {},
+        user = {},
+        body = {},
+        headers = {},
+    } = req;
+
+    const { type, id = body?.id } = params;
+
+    if (!type) {
+        return reply.status(400).send('not enough params: type');
+    }
+
+    const arr = config.pg ? await pg.query(`select array_agg(relname)::text[] from pg_class a 
+    left join pg_namespace b on a.relnamespace=b.oid 
+    where a.relam=2 and b.nspname='data'`).then(el => el.rows?.[0]?.array_agg || []) : [];
+
+    if (!arr.length) {
+        return reply.status(400).send('empty schema: data');
+    }
+
+    const table = arr.find(el => el === params.type);
+
+    const { content_id: contentId, type: contentType } = await pg.query(
+        'select content_id, (select type from site.content_types where content_type_id=t.content_type_id) from site.contents t where slug=$1',
+        [['single', 'pages'].includes(type) ? id : type],
+    ).then(el => el.rows?.[0] || {});
+
+    const ctypeId = contentId && contentId !== 'pages' && contentType === 'single' ? await pg.query(
+        'select content_type_id from site.contents where content_id=$1',
+        [contentId],
+    ).then(el => el.rows?.[0]?.content_type_id) : null;
+
+    const { ctid, dbtable, columns: contentColumns } = await pg.query(
+        'select content_type_id as ctid, table_name as dbtable, columns from site.content_types where $1 in (content_type_id, name)',
+        [type === 'single' && id ? id : (ctypeId || type)],
+    ).then(el => el.rows?.[0] || {});
+
+    const loadTable = (ctypeId || type) === 'pages' ? await getTemplate('table', 'single.default.table') : {};
+
+    const columns = (ctypeId || type) === 'pages'
+        ? (loadTable?.columns || []).concat(contentColumns.filter(col => loadTable?.columns.findIndex(el => el.name === col.name) === -1))
+        : contentColumns;
+
+    // site.content_data, includes singletone
+    if (((!table && !dbtable) || type === 'pages')) {
+        const cid = await pg.query(
+            'select content_id from site.contents where content_type_id=$1 limit 1',
+            [ctid || 'pages'],
+        ).then(el => el.rows?.[0]?.content_id);
+
+        const ctid1 = body.content_type_id || ctid || 'pages';
+
+        if (!cid) {
+            return reply.status(404).send('contents not found');
+        }
+
+        const columnList = columns?.map?.(el => el.name) || [];
+        const types = columns?.reduce?.((acc, curr) => ({ ...acc, [curr.name]: curr.type || 'text' }), {}) || {};
+        const keys = Object.keys(body || {}).filter(key => columnList.includes(key) && !defaultColumns.includes(key));
+
+        if (!Object.keys(body || {}).length) {
+            return reply.status(400).send('invalid payload');
+        }
+
+        // const xss = checkXSS({ body });
+        const sql = checkSQL({ body });
+
+        if (/*xss.error ||*/ sql.error && false) {
+            logger.file(`injection/${/*xss.error ? 'xss' : */'sql'}/cms`, {
+                table,
+                ...params,
+                uid: user?.uid,
+                ...(/*xss.error ? xss : */sql),
+            });
+            return reply
+                .status(409)
+                .send(
+                    `Дані містять заборонені ${/*xss.error ? 'xss' : */'sql'} символи. Приберіть їх та спробуйте ще раз`
+                );
+        }
+
+        const client = await pg.connect();
+
+        try {
+            await client.query('begin');
+            const res = await dataInsert({
+                pg: client,
+                table: 'site.contents',
+                id,
+                data: { ...body, content_type_id: ctid1 },
+                uid: user?.uid,
+            }).then(el => el.rows?.[0] || {});
+
+            if (!res?.content_id) throw new Error('insert contents error');
+
+            await Promise.all(keys.map(async key => dataInsert({
+                pg: client,
+                table: 'site.content_data',
+                data: {
+                    field_key: key,
+                    content_id: res.content_id,
+                    object_id: res.content_id,
+                    field_type: types[key] || 'text',
+                    field_value: inputTypes[types[key] || ''] === 'json' ? undefined : body[key],
+                    field_value_object: inputTypes[types[key] || ''] === 'json' ? body[key] : undefined,
+                },
+                uid: user?.uid,
+            })));
+
+            await updateLocalization(client, res.content_id, body, ctid1, user?.uid);
+
+            if (body?.tag_list?.length) {
+                await Promise.all(body.tag_list.map(async tag => dataInsert({
+                    pg: client,
+                    table: 'site.tag_data',
+                    data: {
+                        tag_id: tag,
+                        data_id: id,
+                    },
+                    uid: user?.uid,
+                })));
+            }
+
+            await client.query('commit');
+
+            return {
+                id: res.content_id, rows: [res].filter(Boolean)
+            };
+        } catch (err) {
+            await client.query('rollback');
+            return reply.status(500).send(err.toString());
+        } finally {
+            client.release();
+        }
+    }
+
+    // custom table
+    if (!table && !dbtable) {
+        return reply.status(400).send('invalid params: type');
+    }
+
+    const client = await pg.connect();
+
+    try {
+        await client.query('begin');
+
+        // const types = columns?.reduce?.((acc, curr) => ({ ...acc, [curr.name]: inputTypes[curr.type] || 'text' }), {}) || {};
+        const { rows = [] } = await dataInsert({
+            pg: client,
+            id,
+            table: 'data.' + `"${(table || dbtable)}"`,
+            data: body,
+            referer: headers?.referer,
+            uid: user?.uid,
+        }).catch(err => {
+            if (err.message?.includes?.('unique constraint')) {
+                throw new Error('Порушенні унікальності: ' + err.message?.match?.(/([^']+)/g)?.[1]);
+            }
+            throw err;
+        }) || {};
+
+        const idRes = rows?.[0]?.id;
+
+        if (!idRes) {
+            throw new Error('content insert error');
+        }
+
+        await updateLocalization(client, idRes, body, ctid, user?.uid);
+
+        if (body?.tag_list?.length) {
+            await Promise.all(body.tag_list.map(async tag => dataInsert({
+                pg: client,
+                table: 'site.tag_data',
+                data: {
+                    tag_id: tag,
+                    data_id: id || idRes,
+                },
+                uid: user?.uid,
+            })));
+        }
+
+        await client.query('commit');
+
+        return reply.status(200).send({ id: idRes, rows });
+    } catch (err) {
+        await client.query('rollback');
+        return reply.status(500).send(err.toString());
+    } finally {
+        client.release();
+    }
 }

package/server/routes/cms/controllers/listMedia.js

@@ -1,73 +1,94 @@
-import path from 'node:path';
-import { existsSync, mkdirSync } from 'node:fs';
-import { readdir, stat } from 'node:fs/promises';
-
-import { config, getFolder, pgClients } from '@opengis/fastify-table/utils.js';
-
-const rootDir = getFolder(config, 'local');
-mkdirSync(path.join(rootDir, 'media'), { recursive: true });
-
-export default async function listMedia(req, reply) {
-    const { pg = pgClients.client, query = {} } = req;
-    const { subdir = '' } = query;
-
-    if (!pg.pk?.['site.media']) {
-        return reply.status(404).send('table not found');
-    }
-
-    if (typeof subdir !== 'string' || subdir.includes('..')) {
-        return reply.status(403).send('invalid params: subdir');
-    }
-
-    const relpath = path.join('/media', subdir).replace(/\\/g, '/');
-    const dirpath = path.join(rootDir, relpath).replace(/\\/g, '/');
-
-    if (!existsSync(dirpath)) {
-        return { data: [], relpath, msg: 'directory not exists' };
-    }
-
-    const { rows = [] } = await pg.query(
-        `select 
-            media_id as id, filename, filetype, filesize, url, description, alt,
-            mime, preview_url, created_at, updated_at, created_by, updated_by
-        from site.media
-        where url ~ $1`,
-        [relpath],
-    );
-
-    const isDirectory = (await stat(dirpath)).isDirectory();
-
-    const items = isDirectory ? await readdir(dirpath, { withFileTypes: true }) : [];
-
-    const subdirs = items
-        .filter(el => el.isDirectory())
-        .map(el => ({ type: 'dir', name: el.name }));
-
-    if (subdirs.length) {
-        await Promise.all(subdirs.map(async (item) => {
-            const items = isDirectory ? await readdir(path.join(dirpath, item.name)) : [];
-            Object.assign(item, { count: items.length });
-        }));
-    }
-
-    const result = { relpath, data: rows.concat(subdirs) };
-
-    if (config.debug) {
-        Object.assign(result, { rootDir });
-    }
-
-    if (!rows.length) {
-        return result;
-    }
-
-    rows.forEach(row => Object.assign(row, {
-        type: 'file',
-        url: `${req.routeOptions.url}/${row.id}/file`,
-        filepath: row.url,
-        name: row.filename,
-        metadata: `${req.routeOptions.url}/${row.id}`,
-        exists: !!items.find(el => el.isFile() && el.name === path.basename(row.url))
-    }));
-
-    return result;
+import path from 'node:path';
+import { existsSync, mkdirSync } from 'node:fs';
+import { readdir, stat } from 'node:fs/promises';
+
+import { config, getFolder, pgClients, getMimeType } from '@opengis/fastify-table/utils.js';
+import { createHash } from 'node:crypto';
+
+const rootDir = getFolder(config, 'local');
+const dir = '/files';
+
+mkdirSync(path.join(rootDir, dir), { recursive: true });
+
+export default async function listMedia(req, reply) {
+    const { pg = pgClients.client, query = {} } = req;
+    const { subdir: subdir1 = '', search } = query;
+
+    if (!pg.pk?.['site.media']) {
+        return reply.status(404).send('table not found');
+    }
+
+    if (typeof subdir1 !== 'string' || subdir1.includes('..')) {
+        return reply.status(403).send('invalid params: subdir');
+    }
+
+    const subdir = subdir1.replace(/\/{2,}/g, '/');
+    const relpath = path.join(dir, subdir1).replace(/\\/g, '/');
+    const dirpath = path.join(rootDir, relpath).replace(/\\/g, '/');
+
+    if (!existsSync(dirpath)) {
+        return { data: [], relpath, msg: 'directory not exists' };
+    }
+
+    const isDirectory = (await stat(dirpath)).isDirectory();
+
+    const allItems = isDirectory ? await readdir(dirpath, { withFileTypes: true, recursive: true }) : [];
+    const items = isDirectory ? await readdir(dirpath, { withFileTypes: true }) : [];
+
+    const rows = await pg.query(
+        `select 
+            media_id as id, filename, filetype, filesize, url, description, alt,
+            mime, preview_url, created_at, updated_at, created_by, updated_by
+        from site.media
+        where ${subdir ? 'subdir = $1' : (search ? '1=1' : 'subdir is null')} ${search ? `and filename ilike '%${search.replace(/'/g, "''")}%'` : ''}`,
+        [subdir].filter(Boolean),
+    ).then(el => el.rows || []); // ?.filter(row => items.map(el => el.name).includes(row.filename))
+
+    const subdirs = items
+        .filter(el => el.isDirectory())
+        .map(el => ({ type: 'dir', name: el.name }))
+        .filter(el => search ? el.name.includes(search) : true);
+
+    if (subdirs.length) {
+        await Promise.all(subdirs.map(async (item) => {
+            const items = isDirectory ? await readdir(path.join(dirpath, item.name)) : [];
+            Object.assign(item, { count: items.length });
+        }));
+    }
+
+    const result = { relpath };
+
+    if (config.debug) {
+        Object.assign(result, { rootDir });
+    }
+
+    const files = (search ? allItems.filter(el => el.name.includes(search)) : items)
+        .filter(el => el.isFile())
+        .map(el => {
+            const media = rows.find(row => row.filename === el.name);
+            const filepath = media ? media.url : ('/files/' + (el.path.split('/files/')[1] ? el.path.split('/files/')[1] + '/' : '') + el.name);
+            return media ? {
+                type: 'file',
+                ...media,
+                url: `${req.routeOptions.url}/${media.id}/file`,
+                preview: `${req.routeOptions.url}/${media.id}/preview`,
+                filepath,
+                metadata: `${req.routeOptions.url}/${media.id}`,
+            } : {
+                id: createHash('md5').update(filepath).digest('hex'),
+                hash: true,
+                type: 'file',
+                filename: el.name,
+                filepath,
+                filetype: getMimeType(el.name)?.startsWith('image/') ? "image" : "other",
+                filesize: 0,
+                url: filepath,
+                mime: getMimeType(el.name),
+                preview: filepath,
+            }
+        });
+
+    Object.assign(result, { data: subdirs.concat(files) });
+    return result;
+
 }

package/server/routes/cms/controllers/metadataMedia.js

@@ -1,37 +1,38 @@
-import path from 'node:path';
-import { existsSync } from 'node:fs';
-
-import { config, getFolder, pgClients } from "@opengis/fastify-table/utils.js";
-
-const rootDir = getFolder(config, 'local');
-
-export default async function metadataMedia({
-    routeOptions = {}, pg = pgClients.client, params = {},
-}, reply) {
-    if (!params?.id) {
-        return reply.status(400).send('not enough params: id');
-    }
-
-    if (!pg.pk?.['site.media']) {
-        return reply.status(404).send('table not found');
-    }
-
-    const data = await pg.query(
-        'select * from site.media where media_id = $1 and url is not null',
-        [params.id],
-    ).then(el => el.rows?.[0]);
-
-    if (!data) {
-        return reply.status(404).send('media not found: ' + params.id);
-    }
-
-    const filepath = path.join(rootDir, data.url);
-
-    Object.assign(data, {
-        url: `${routeOptions.url.replace(':id', params.id)}/file`,
-        filepath: data.url,
-        exists: existsSync(filepath),
-    });
-
-    return reply.status(200).send(data);
-}
+import path from 'node:path';
+import { existsSync } from 'node:fs';
+
+import { config, getFolder, pgClients } from "@opengis/fastify-table/utils.js";
+
+const rootDir = getFolder(config, 'local');
+
+export default async function metadataMedia({
+    routeOptions = {}, pg = pgClients.client, params = {},
+}, reply) {
+    if (!params?.id) {
+        return reply.status(400).send('not enough params: id');
+    }
+
+    if (!pg.pk?.['site.media']) {
+        return reply.status(404).send('table not found');
+    }
+
+    const data = await pg.query(
+        'select * from site.media where media_id = $1 and url is not null',
+        [params.id],
+    ).then(el => el.rows?.[0]);
+
+    if (!data) {
+        return reply.status(404).send('media not found: ' + params.id);
+    }
+
+    const filepath = path.join(rootDir, data.url);
+
+    Object.assign(data, {
+        url: `${routeOptions.url.replace(':id', params.id)}/file`,
+        preview: `${routeOptions.url.replace(':id', params.id)}/preview`,
+        filepath: data.url,
+        exists: existsSync(filepath),
+    });
+
+    return reply.status(200).send(data);
+}

package/server/routes/cms/controllers/properties.get.js

@@ -0,0 +1,53 @@
+/* eslint-disable camelcase */
+import { pgClients } from '@opengis/fastify-table/utils.js';
+
+export default async function getAppSettings(
+  {
+    pg = pgClients.client,
+    query,
+    params,
+    user = {},
+  },
+  reply
+) {
+  const t1 = Date.now();
+
+  if (!pg) {
+    return reply.status(500).send("empty pg");
+  }
+
+  if (!pg.pk?.["admin.properties"]) {
+    return reply.status(404).send("properties table not found");
+  }
+
+  if (params?.entity === "user" && !user.uid) {
+    return reply.status(401).send("unauthorized");
+  }
+
+  const { uid } = user || {};
+
+  const args =
+    params?.entity === "user" ? [user.uid] : [params?.entity || "app"];
+
+  const { rows = [] } = await pg.query(
+    "select property_key as key, property_text, property_json from admin.properties where property_entity=$1",
+    args
+  );
+
+  const settings = rows
+    .filter((row) =>
+      typeof query?.keys === "string" ? query.keys.includes(row.key) : true
+    )
+    .reduce(
+      (
+        acc,
+        { key, property_text, property_json }
+      ) => ({
+        ...acc,
+        [key]: property_text || property_json,
+      }),
+      {}
+    );
+
+  return reply.status(200).send({ time: Date.now() - t1, uid, settings });
+}