@opengis/cms 0.0.16 → 0.0.18

package/server/routes/cms/controllers/updateContent.js

@@ -1,112 +1,239 @@
-import { config, pgClients, dataUpdate, dataInsert } from '@opengis/fastify-table/utils.js';
-
-import builderCache from '../../contentType/utils/builderCache.js';
-
-export default async function updateContent(req, reply) {
-    const {
-        pg = pgClients.client,
-        params = {},
-        user = {},
-        body = {},
-        headers = {},
-    } = req;
-
-    const { type, id } = params;
-
-    if (!type) {
-        return reply.status(400).send('not enough params: type');
-    }
-
-    if (!id) {
-        return reply.status(400).send('not enough params: id');
-    }
-
-    if (!Object.keys(body || {}).length) {
-        return reply.status(400).send('empty body');
-    }
-
-    if (type === 'single') {
-        const cache = builderCache(id) || {};
-        if (!cache) {
-            return reply.status(400).send('invalid params: id');
-        }
-
-        const client = await pg.connect();
-
-        try {
-            await client.query('BEGIN');
-            // await client.query('SET statement_timeout = 100000000;');
-            await client.query(`delete from site.single_type_values where type_name=$1`, [id]);
-
-            await Promise.all(Object.keys(body).filter(key => body[key]).map(async key => dataInsert({
-                pg: client,
-                table: 'site.single_type_values',
-                data: { key, value: body[key], type_name: id },
-                referer: headers?.referer,
-                uid: user?.uid || 0,
-            })));
-
-            // await client.query('SET statement_timeout = 0;');
-
-            await client.query('COMMIT');
-            return reply.status(200).send({ id, ...body });
-        }
-        catch (err) {
-            await client.query('ROLLBACK');
-            return reply.status(500).send(err.toString());
-        }
-        finally {
-            client.release();
-        }
-    }
-
-    if (builderCache[type]?.table && builderCache[type]?.provider === 'pg' && config.pg) {
-        const result = await dataUpdate({
-            pg,
-            id,
-            table: 'site.' + builderCache[type]?.table,
-            data: body,
-            referer: headers?.referer,
-            uid: user?.uid || 0,
-        }).catch(err => {
-            if (err.message?.includes?.('unique constraint')) {
-                return reply.status(400).send('Порушенні унікальності: ' + err.message?.match?.(/([^"]+)/g)?.[1]);
-            }
-            return reply.status(500).send(err.toString());
-        });
-
-        const pk = pg.pk?.['site.' + builderCache[type]?.table];
-        return reply.status(200).send({ id: result?.[pk], ...result || {} });
-    }
-
-    const arr = config.pg ? await pg.query(`select array_agg(relname)::text[] from pg_class a 
-    left join pg_namespace b on a.relnamespace=b.oid 
-    where a.relam=2 and b.nspname='site'`).then(el => el.rows?.[0]?.array_agg || []) : [];
-
-    if (!arr.length) {
-        return reply.status(400).send('empty schema: site');
-    }
-
-    const table = arr.find(el => el === params.type);
-
-    if (!table) {
-        return reply.status(400).send('invalid params: type');
-    }
-
-    const result = await dataUpdate({
-        pg,
-        id,
-        table: 'site.' + table,
-        data: body,
-        referer: headers?.referer,
-        uid: user?.uid || 0,
-    }).catch(err => {
-        if (err.message?.includes?.('unique constraint')) {
-            return reply.status(400).send('Порушенні унікальності: ' + err.message?.match?.(/([^"]+)/g)?.[1]);
-        }
-        return reply.status(500).send(err.toString());
-    });
-
-    const pk = pg.pk?.['site.' + table];
-    return reply.status(200).send({ id: result?.[pk], ...result || {} });
+import { config, pgClients, dataUpdate, dataInsert, getTemplate, checkSQL, logger } from '@opengis/fastify-table/utils.js';
+
+import { existsSync, readFileSync } from 'node:fs';
+
+const inputTypes = existsSync('input-types.json') ? JSON.parse(readFileSync('input-types.json') || '{}') : {};
+
+import updateLocalization from '../utils/updateLocalization.js';
+
+const defaultColumns = [
+    'content_id',
+    'space_id',
+    'content_type_id',
+    'created_at',
+    'updated_at',
+    'published_at',
+    'revision',
+    'locale',
+    'status',
+    'slug',
+    'title',
+    'created_by',
+    'published_by',
+    'updated_by',
+    'meta',
+];
+
+export default async function updateContent(req, reply) {
+    const {
+        pg = pgClients.client,
+        params = {},
+        user = {},
+        body = {},
+        headers = {},
+    } = req;
+
+    const { type, id } = params;
+
+    if (!type) {
+        return reply.status(400).send('not enough params: type');
+    }
+
+    if (!id) {
+        return reply.status(400).send('not enough params: id');
+    }
+
+    if (!Object.keys(body || {}).length) {
+        return reply.status(400).send('empty body');
+    }
+
+    const arr = config.pg ? await pg.query(`select array_agg(relname)::text[] from pg_class a 
+    left join pg_namespace b on a.relnamespace=b.oid 
+    where a.relam=2 and b.nspname='data'`).then(el => el.rows?.[0]?.array_agg || []) : [];
+
+    if (!arr.length) {
+        return reply.status(400).send('empty schema: data');
+    }
+
+    const table = arr.find(el => el === params.type);
+
+    // order priority - custom columns -> default for pages
+    const { ctid, ctname, dbtable, columns: contentColumns = [] } = await pg.query('select content_type_id as ctid, name as ctname, table_name as dbtable, columns from site.content_types where content_type_id in (select content_type_id from site.contents where content_id=$1) or content_type_id=$2 order by content_type_id = \'pages\'', [id, type]).then(el => el.rows?.[0] || {});
+
+
+    const loadTable = type === 'pages' ? await getTemplate('table', 'single.default.table') : {};
+    const columns = type === 'pages'
+        ? (loadTable?.columns || []).concat(contentColumns.filter(col => loadTable?.columns.findIndex(el => el.name === col.name) === -1))
+        : contentColumns;
+
+    // const xss = checkXSS({ body });
+    const sql = checkSQL({ body });
+
+    if (/*xss.error ||*/ sql.error && false) {
+        logger.file(`injection/${/*xss.error ? 'xss' : */'sql'}/cms`, {
+            table,
+            ...params,
+            uid: user?.uid,
+            ...(/*xss.error ? xss : */sql),
+        });
+        return reply
+            .status(409)
+            .send(
+                `Дані містять заборонені ${/*xss.error ? 'xss' : */'sql'} символи. Приберіть їх та спробуйте ще раз`
+            );
+    }
+
+    // site.content_data, includes singletone
+    if (((!table && !dbtable) || ['single', 'pages'].includes(type)) && ctid) {
+        const cid = await pg.query(
+            'select content_id from site.contents where content_type_id=$1 limit 1',
+            [ctid],
+        ).then(el => el.rows?.[0]?.content_id);
+
+        const ctid1 = body.content_type_id || ctid;
+
+        if (!cid) {
+            return reply.status(404).send('contents not found');
+        }
+
+        const contentId = cid === 'pages'
+            ? await pg.query('select content_id from site.content_data where object_id=$1', [id]).then(el => el.rows?.[0]?.content_id)
+            : cid;
+
+        if (!contentId) {
+            return reply.status(404).send('contents not found: 2');
+        }
+
+        const columnList = columns?.map?.(el => el.name) || [];
+        const types = columns?.reduce?.((acc, curr) => ({ ...acc, [curr.name]: curr.type || 'text' }), {}) || {};
+        const keys = Object.keys(body || {}).filter(key => columnList.includes(key) && !defaultColumns.includes(key));
+
+
+        if (!Object.keys(body || {}).length) {
+            return reply.status(400).send('invalid payload');
+        }
+
+        const blocks = await pg.query(`select json_object_agg(field_key,field_value) from site.content_data where content_id=$1 and field_type='reference'`, [id])
+            .then(el => el.rows?.[0]?.json_object_agg || {});
+
+        const emptyBlock = Object.keys(body).find(key => blocks[key] && (!body[key] || typeof body[key] !== 'object' || Object.keys(body[key] || {}) === 0));
+
+        if (emptyBlock) {
+            return reply.status(400).send('access restricted: empty/invalid block ' + emptyBlock);
+        }
+
+        const client = await pg.connect();
+
+        try {
+            await client.query('begin');
+            const res = await dataUpdate({
+                pg: client,
+                table: 'site.contents',
+                id,
+                data: { ...body, content_type_id: ctid1 },
+                uid: user?.uid,
+            });
+            await client.query(`delete from site.content_data where content_id=$1`, [contentId]);
+            const objectId = (ctname === 'pages' || ['single', 'pages'].includes(type)) && id ? id : cid;
+            await client.query(`delete from site.content_data where object_id=$1`, [objectId]);
+            await Promise.all(keys.map(async key => dataInsert({
+                pg: client,
+                table: 'site.content_data',
+                data: {
+                    field_key: key,
+                    content_id: objectId,
+                    object_id: objectId,
+                    field_type: types[key] || 'text',
+                    field_value: inputTypes[types[key] || ''] === 'json' || key === 'meta' ? undefined : body[key],
+                    field_value_object: inputTypes[types[key] || ''] === 'json' || key === 'meta' ? body[key] : undefined,
+                },
+                uid: user?.uid,
+            })));
+
+            // if pages allow localization, update localization
+            const localeRes = await updateLocalization(client, id, body, type === 'pages' ? type : ctid1, user?.uid);
+
+            if (Object.hasOwn(body, 'tag_list')) {
+                await client.query('delete from site.tag_data where data_id=$1', [id]);
+                if (body.tag_list?.length) {
+                    await Promise.all(body.tag_list.map(async tag => dataInsert({
+                        pg: client,
+                        table: 'site.tag_data',
+                        data: {
+                            tag_id: tag,
+                            data_id: id,
+                        },
+                        uid: user?.uid,
+                    })));
+                    Object.assign(res, { tag_list: body.tag_list });
+                }
+            }
+
+            await client.query('commit');
+
+            return {
+                id, ...res || {}, ...(keys || []).reduce((acc, curr) => ({ ...acc, [curr]: body[curr] }), {}), ...(localeRes || {})
+            };
+        } catch (err) {
+            await client.query('rollback');
+            return reply.status(500).send(err.toString());
+        } finally {
+            client.release();
+        }
+    }
+
+    if (!table && !dbtable) {
+        return reply.status(400).send('invalid params: type');
+    }
+
+    const client = await pg.connect();
+
+    try {
+        await client.query('begin');
+
+        const result = await dataUpdate({
+            pg: client,
+            id,
+            table: 'data.' + `"${(table || dbtable)}"`,
+            data: body,
+            referer: headers?.referer,
+            uid: user?.uid,
+        }).catch(err => {
+            if (err.message?.includes?.('unique constraint')) {
+                throw new Error('Порушенні унікальності: ' + err.message?.match?.(/([^"]+)/g)?.[1]);
+            }
+            throw err;
+        });
+
+        await updateLocalization(client, result?.id, body, ctid, user?.uid);
+
+        if (Object.hasOwn(body, 'tag_list')) {
+            await client.query('delete from site.tag_data where data_id=$1', [id]);
+            if (body.tag_list?.length) {
+                await Promise.all(body.tag_list.map(async tag => dataInsert({
+                    pg: client,
+                    table: 'site.tag_data',
+                    data: {
+                        tag_id: tag?.id,
+                        data_id: id,
+                    },
+                    uid: user?.uid,
+                })));
+                Object.assign(result, { tag_list: body.tag_list });
+            }
+        }
+
+        await client.query('commit');
+
+        if (!result?.id) {
+            return reply.status(404).send('content not found');
+        }
+
+        return reply.status(200).send(result);
+    } catch (err) {
+        await client.query('rollback');
+        return reply.status(500).send(err.toString());
+    } finally {
+        client.release();
+    }
 }

package/server/routes/cms/controllers/uploadMedia.js

@@ -1,66 +1,79 @@
-import path from 'node:path';
-import { mkdir, rename } from 'node:fs/promises';
-
-import { config, getFolder, dataInsert, pgClients } from "@opengis/fastify-table/utils.js";
-
-import { getMimeType, getFileType, uploadMultiPart } from '@opengis/fastify-file/utils.js';
-import { existsSync } from 'node:fs';
-
-const rootDir = getFolder(config, 'local');
-
-export default async function uploadMedia(req, reply) {
-    const { pg = pgClients.client, user = {}, body = {}, query = {} } = req;
-
-    if (!pg.pk?.['site.media']) {
-        return reply.status(404).send('table not found');
-    }
-
-    if (query.subdir && (typeof query.subdir !== 'string' || query.subdir.includes('..'))) {
-        return reply.status(403).send('invalid query params: subdir');
-    }
-
-    // upload assets
-    if (req.headers['content-type']?.split?.(';')?.shift?.() === 'multipart/form-data') {
-        const file = await uploadMultiPart(req);
-        const filename = `${file.newFilename}${path.extname(file.filepath)}`;
-        const mime = getMimeType(file.filepath);
-        const filetype = getFileType(file.filepath);
-
-        const newfilepath = path.join(rootDir, 'media', query.subdir || '', filename);
-        await mkdir(path.dirname(newfilepath), { recursive: true });
-        await rename(file.filepath, newfilepath);
-
-        const relpath = path.join('/media', query.subdir || '', filename).replace(/\\/g, '/');
-        const id = await dataInsert({
-            pg,
-            table: 'site.media',
-            data: {
-                filename: file.originalFilename,
-                filetype,
-                url: relpath,
-                mime,
-                filesize: file.size,
-            },
-            uid: user?.uid || 0,
-        }).then(el => el?.rows?.[0]?.media_id);
-
-        return reply.status(200).send({
-            relpath: path.join('/media', query.subdir || '').replace(/\\/g, '/'),
-            id,
-            filename,
-            filetype,
-            type: 'file',
-        });
-    }
-
-    // create directory
-    const relpath = path.join('/media', query.subdir).replace(/\\/g, '/');
-    const dirpath = path.join(rootDir, relpath);
-    await mkdir(dirpath, { recursive: true });
-
-    return reply.status(200).send({
-        relpath,
-        dirname: path.basename(query.subdir),
-        type: 'dir',
-    });
+import path from 'node:path';
+import { mkdir } from 'node:fs/promises';
+
+import { uploadMultiPart, config, getFolder, dataInsert, pgClients } from "@opengis/fastify-table/utils.js";
+
+const rootDir = getFolder(config, 'local');
+const dir = '/files';
+
+export default async function uploadMedia(req, reply) {
+    const { pg = pgClients.client, user = {}, query = {} } = req;
+
+    if (!pg?.pk?.['site.media']) {
+        return reply.status(404).send('table not found');
+    }
+
+    if (query.subdir && (typeof query.subdir !== 'string' || query.subdir.includes('..'))) {
+        return reply.status(403).send('invalid query params: subdir');
+    }
+
+    // upload assets
+    if (req.headers['content-type']?.split?.(';')?.shift?.() === 'multipart/form-data') {
+        const file = await uploadMultiPart(req, { subdir: query.subdir || '', originalFilename: true }).catch(err => {
+            if (err.message === 'file with specified name already exists in directory') {
+                err.message = 'Файл з вказаною назвою вже існує';
+                err.statusCode = 400;
+            }
+            throw err;
+        });
+
+        const { originalFilename: filename, filetype, mimetype } = file;
+        const relpath = path.join(dir, query.subdir || '', file.originalFilename).replace(/\\/g, '/');
+
+        const id = await dataInsert({
+            pg,
+            table: 'site.media',
+            data: {
+                filename,
+                filetype,
+                subdir: query.subdir,
+                url: relpath,
+                mime: mimetype,
+                filesize: file.size,
+            },
+            uid: user?.uid,
+        }).then(el => el?.rows?.[0]?.media_id);
+
+        return reply.status(200).send({
+            res: 'ok',
+            name: filename,
+            type: 'file',
+            mimetype,
+            result: {
+                file_id: id,
+                format: file.extension,
+                size: file.size,
+                // entity_id: resultInsert?.entity_id,
+                file_path: relpath,
+                file_name: filename,
+                dir: path.dirname(relpath).replace(/\\/g, '/'),
+                native_file_name: filename,
+            },
+        });
+    }
+
+    if (!query.subdir) {
+        return reply.status(400).send('not enough query params: subdir');
+    }
+
+    // create directory
+    const relpath = path.join(dir, query.subdir).replace(/\\/g, '/');
+    const dirpath = path.join(rootDir, relpath);
+    await mkdir(dirpath, { recursive: true });
+
+    return reply.status(200).send({
+        relpath,
+        dirname: path.basename(query.subdir),
+        type: 'dir',
+    });
 }

package/server/routes/cms/index.mjs

@@ -1,3 +1,5 @@
+import { config } from '@opengis/fastify-table/utils.js';
+
 // perimissions
 import getPermissions from './controllers/getPermissions.js';
 import setPermissions from './controllers/setPermissions.js';
@@ -11,35 +13,102 @@ import download from './controllers/downloadMedia.js';
 
 // content
 import getContent from './controllers/getContent.js';
+import getContentBySlug from './controllers/getContentBySlug.js';
 import insertContent from './controllers/insertContent.js';
 import updateContent from './controllers/updateContent.js';
 import deleteContent from './controllers/deleteContent.js';
+import { translateContent, translateCollection } from './controllers/translate.js';
+
+// suggest
+import cmsSuggest from './controllers/cmsSuggest.js';
+
+// statistics
+import cmsStat from './controllers/cmsStat.js';
+import searchContent from './controllers/searchContent.js';
+
+import getAppSettings from "./controllers/properties.get.js";
+import postAppSettings from "./controllers/properties.post.js";
+
+const suggestSchema = {
+    querystring: {
+        type: 'object',
+        properties: {
+            search: { type: 'string' },
+            filter: { type: 'string' },
+            limit: { type: 'number', exclusiveMinimum: 0 },
+        },
+    },
+};
 
-const schemaObj = {
-    type: 'object',
+const propertiesSchema = {
+    type: "object",
     properties: {
         params: {
-            type: 'string',
-            enum: ['preview', 'download'],
-        }
-    }
+            id: { type: "string", pattern: "^([\\d\\w]+)$" },
+            key: { type: "string", pattern: "^([\\d\\w._]+)$" },
+        },
+        querystring: {
+            json: { type: "string", pattern: "^([\\d\\w]+)$" },
+        },
+    },
 };
 
-const params = { config: { policy: ['public'] } };
+const translateContentSchema = {
+    type: "object",
+    properties: {
+        params: {
+            id: {
+                type: "string"
+            },
+        },
+        querystring: {
+            required: ['to'],
+            additionalProperties: false,
+            from: {
+                type: "string"
+            },
+            to: {
+                type: "string"
+            },
+        },
+    },
+};
+
+const params = { config: { policy: 'L0' } };
 
 export default async function route(app) {
-    app.post('/cms-permissions/:id', params, setPermissions);
+    app.post('/cms-permissions/:id', { config: { role: 'admin' } }, setPermissions);
     app.get('/cms-permissions/:id?', params, getPermissions);
+    app.get('/cms-translate', { config: { role: "admin" }, schema: translateContentSchema }, translateContent);
+    app.get('/cms-translate-collection/:id', { config: { role: "admin" }, schema: translateContentSchema }, translateCollection);
 
     app.post('/cms-media/upload', params, uploadMedia);
     app.get('/cms-media', params, listMedia);
-    app.get('/cms-media/:id/file', { ...params, schema: schemaObj }, download);
+    app.get('/cms-media/:id/:type', params, download);
     app.get('/cms-media/:id', params, metadata);
-    app.delete('/cms-media/:id', params, del);
+    app.delete('/cms-media/:id?', params, del); // media file with id / subdir without
     app.get('/cms-media/:id/delete', params, del); // debug
 
-    app.get('/cms/:type/:id?', params, getContent);
+    // Bearer token required
+    app.get('/cms-content/:slug/:lang?', params, getContentBySlug);
+    app.get('/cms-search', params, searchContent);
+    app.get('/cms/:type', params, getContent);
+    app.get('/cms/:type/:id/:lang?', params, getContent);
+
     app.post('/cms/:type/:id?', params, insertContent);
-    app.put('/cms/:type/:id', params, updateContent);
+    app.put('/cms/:type/:id?', params, updateContent);
     app.delete('/cms/:type/:id', params, deleteContent);
+
+    app.get('/cms-suggest/:id', { ...params, schema: suggestSchema }, cmsSuggest);
+    app.get('/cms-stat', params, cmsStat);
+    app.get(
+        "/settings",
+        { config: { policy: "L0" }, schema: propertiesSchema },
+        getAppSettings
+    );
+    app.post(
+        "/settings",
+        { config: { policy: "L0" } },
+        postAppSettings
+    );
 }

package/server/routes/cms/utils/additionalData.js

@@ -0,0 +1,36 @@
+export default async function additionalData(pg, rows, locale, fields = '*') {
+    const { rows: localizations = [] } = await pg.query(`select json_object_agg(field_key, field_value), object_id from site.localization 
+    where object_id=any($1) and ${locale && locale !== 'uk' ? 'REVERSE(split_part(REVERSE(field_key), \':\', 1)) = $2' : '1=1'} group by object_id`, [rows.map(el => el.id), locale && locale !== 'uk' ? locale : null].filter(Boolean));
+
+    const { rows: tagsList = [] } = await pg.query(`
+    SELECT 
+    td.data_id,
+    json_agg(
+        json_build_object('id', t.tag_id, 'text', t.value, 'color', t.color, 'slug', t.slug, 'locale', t.locale)
+    ) AS tag
+    FROM site.tag_data td
+    JOIN site.tags t ON t.tag_id = td.tag_id
+    where data_id=any($1) 
+    GROUP BY td.data_id;    
+    `, [rows.map(el => el.id)]);
+
+    rows.forEach(row => {
+        if (locale && locale !== 'uk' && row.meta && Object.keys(row.meta || {}).find(key => key.split(':').pop() === locale)) {
+            row.meta = Object.fromEntries(Object.keys(row.meta || {}).filter(key => key.split(':').pop() === locale && row.meta?.[key]).map(key => [key.split(':').shift(), row.meta[key]]));
+        }
+
+        const localization = localizations.find(el => el.object_id === row.id);
+        const localizationKeys = Object.keys(localization?.json_object_agg || {}).filter(key => row[key.split(':').shift()]);
+        const localizationObj1 = Object.entries(localization?.json_object_agg || {}).filter(([key]) => rows.length > 1 ? true : localizationKeys.includes(key)).reduce((acc, curr) => ({ ...acc, [curr[0]]: typeof curr[1] === 'string' && curr[1].startsWith('[') && curr[1].endsWith(']') ? JSON.parse(curr[1]) : curr[1] }), {});
+        const localizationObj = fields?.length ? Object.fromEntries(Object.entries(localizationObj1).filter(([key]) => fields.split(',').includes(key.split(':').shift()))) : localizationObj1;
+        if (locale && locale !== 'uk') {
+            Object.assign(row, Object.keys(localizationObj).reduce((acc, curr) => ({ ...acc, [curr.replace(`:${locale}`, '')]: localizationObj[curr] }), {}));
+        } else if (!locale) {
+            Object.assign(row, localizationObj);
+        }
+
+        const { tag = [] } = tagsList.find(el => el?.data_id === row?.id) || {};
+        const localizedTags = locale ? tag.map(el => ({ ...el, text: el.locale?.[locale] || el.text })) : tag;
+        Object.assign(row, { tag_list: localizedTags });
+    });
+}