@opengis/fastify-table 1.0.75 → 1.0.77
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/Changelog.md +4 -0
- package/crud/controllers/deleteCrud.js +19 -19
- package/crud/controllers/insert.js +54 -54
- package/crud/controllers/update.js +59 -59
- package/crud/funcs/dataInsert.js +24 -24
- package/crud/funcs/getAccess.js +53 -53
- package/crud/funcs/getOpt.js +10 -10
- package/crud/funcs/setOpt.js +16 -16
- package/helper.js +28 -28
- package/notification/controllers/userNotifications.js +19 -19
- package/notification/funcs/addNotification.js +8 -8
- package/package.json +1 -1
- package/pg/pgClients.js +20 -20
- package/policy/funcs/checkPolicy.js +82 -82
- package/policy/funcs/sqlInjection.js +33 -33
- package/policy/index.js +14 -14
- package/redis/client.js +8 -8
- package/redis/funcs/redisClients.js +2 -2
- package/redis/index.js +19 -19
- package/server/migrations/0.sql +64 -64
- package/server/templates/form/test.dataset.form.json +411 -411
- package/server/templates/select/test.storage.data.json +2 -2
- package/server/templates/table/test.dataset.table.json +24 -24
- package/server/templates/table/test.gis.map.table.json +44 -44
- package/table/controllers/data.js +95 -95
- package/table/controllers/utils/getSelect.js +20 -20
- package/table/controllers/utils/gisIRColumn.js +68 -68
- package/table/funcs/getFilterSQL/index.js +75 -75
- package/table/funcs/getFilterSQL/util/formatValue.js +142 -142
- package/table/funcs/getFilterSQL/util/getCustomQuery.js +13 -13
- package/table/funcs/getFilterSQL/util/getFilterQuery.js +73 -73
- package/table/funcs/getFilterSQL/util/getOptimizedQuery.js +12 -12
- package/table/funcs/metaFormat/getSelectVal.js +20 -20
- package/test/api/crud.test.js +88 -88
- package/util/controllers/status.monitor.js +8 -0
- package/util/index.js +21 -20
- package/widget/controllers/utils/historyFormat.js +76 -76
- package/widget/controllers/utils/obj2db.js +13 -13
- package/widget/controllers/widget.del.js +44 -44
- package/widget/controllers/widget.get.js +96 -96
- package/widget/controllers/widget.set.js +70 -70
package/Changelog.md
CHANGED
|
@@ -1,19 +1,19 @@
|
|
|
1
|
-
import dataDelete from '../funcs/dataDelete.js';
|
|
2
|
-
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
3
|
-
import getAccess from '../funcs/getAccess.js';
|
|
4
|
-
|
|
5
|
-
export default async function deleteCrud(req) {
|
|
6
|
-
const { actions = [], scope, my } = await getAccess(req, req.params.table, req.params.id) || {};
|
|
7
|
-
if (!actions.includes('del') || (scope === 'my' && !my)) {
|
|
8
|
-
return { message: 'access restricted', status: 403 };
|
|
9
|
-
}
|
|
10
|
-
const loadTemplate = await getTemplate('table', req.opt?.table || req.params.table);
|
|
11
|
-
const { table } = loadTemplate || req.opt || req.params || {};
|
|
12
|
-
const { id } = req.opt || req.params || {};
|
|
13
|
-
|
|
14
|
-
if (!table) return { status: 404, message: 'table is required' };
|
|
15
|
-
|
|
16
|
-
const data = await dataDelete({ table, id });
|
|
17
|
-
|
|
18
|
-
return { rowCount: data.rowCount, msg: !data.rowCount ? data : null };
|
|
19
|
-
}
|
|
1
|
+
import dataDelete from '../funcs/dataDelete.js';
|
|
2
|
+
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
3
|
+
import getAccess from '../funcs/getAccess.js';
|
|
4
|
+
|
|
5
|
+
export default async function deleteCrud(req) {
|
|
6
|
+
const { actions = [], scope, my } = await getAccess(req, req.params.table, req.params.id) || {};
|
|
7
|
+
if (!actions.includes('del') || (scope === 'my' && !my)) {
|
|
8
|
+
return { message: 'access restricted', status: 403 };
|
|
9
|
+
}
|
|
10
|
+
const loadTemplate = await getTemplate('table', req.opt?.table || req.params.table);
|
|
11
|
+
const { table } = loadTemplate || req.opt || req.params || {};
|
|
12
|
+
const { id } = req.opt || req.params || {};
|
|
13
|
+
|
|
14
|
+
if (!table) return { status: 404, message: 'table is required' };
|
|
15
|
+
|
|
16
|
+
const data = await dataDelete({ table, id });
|
|
17
|
+
|
|
18
|
+
return { rowCount: data.rowCount, msg: !data.rowCount ? data : null };
|
|
19
|
+
}
|
|
@@ -1,54 +1,54 @@
|
|
|
1
|
-
import dataInsert from '../funcs/dataInsert.js';
|
|
2
|
-
import getToken from '../funcs/getToken.js';
|
|
3
|
-
import checkXSS from './utils/checkXSS.js';
|
|
4
|
-
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
5
|
-
import getAccess from '../funcs/getAccess.js';
|
|
6
|
-
|
|
7
|
-
export default async function insert(req) {
|
|
8
|
-
const { actions = [] } = await getAccess(req, req.params.table) || {};
|
|
9
|
-
if (!actions.includes('edit')) {
|
|
10
|
-
return { message: 'access restricted', status: 403 };
|
|
11
|
-
}
|
|
12
|
-
if (!req.params?.table) {
|
|
13
|
-
return { message: 'table is required', status: 400 };
|
|
14
|
-
}
|
|
15
|
-
const loadTemplate = await getTemplate('table', req.params.table);
|
|
16
|
-
const { table, public: ispublic } = loadTemplate || req.params || {};
|
|
17
|
-
if (!table) {
|
|
18
|
-
return { message: 'table not found', status: 404 };
|
|
19
|
-
}
|
|
20
|
-
|
|
21
|
-
const { funcs = {}, user = {}, params = {} } = req;
|
|
22
|
-
const tokenDataString = await getToken({
|
|
23
|
-
funcs, uid: user.uid, token: params.table, mode: 'a', json: 0,
|
|
24
|
-
});
|
|
25
|
-
|
|
26
|
-
const { form, add } = JSON.parse(tokenDataString || '{}');
|
|
27
|
-
|
|
28
|
-
const formData = form || loadTemplate?.form ? (await getTemplate('form', form || loadTemplate?.form) || {}) : {};
|
|
29
|
-
|
|
30
|
-
const xssCheck = checkXSS({ body: req.body, schema: formData?.schema });
|
|
31
|
-
|
|
32
|
-
if (xssCheck.error && formData?.xssCheck !== false) {
|
|
33
|
-
req.log.warn({ name: 'injection/xss', msg: xssCheck.error, table }, req);
|
|
34
|
-
return { message: 'Дані містять заборонені символи. Приберіть їх та спробуйте ще раз', status: 409 };
|
|
35
|
-
}
|
|
36
|
-
|
|
37
|
-
const { uid } = funcs.config?.auth?.disable || ispublic ? { uid: '1' } : user || {};
|
|
38
|
-
Object.assign(req.body, { uid, editor_id: uid });
|
|
39
|
-
const res = await dataInsert({ table: add || table, data: req.body });
|
|
40
|
-
|
|
41
|
-
const extraKeys = Object.keys(formData)?.filter((key) => formData?.[key]?.type === 'DataTable' && formData?.[key]?.table && formData?.[key]?.parent_id && req.body[key].length);
|
|
42
|
-
if (extraKeys?.length) {
|
|
43
|
-
res.extra = {};
|
|
44
|
-
await Promise.all(extraKeys?.map(async (key) => {
|
|
45
|
-
const extraRows = await Promise.all(req.body[key].map(async (row) => {
|
|
46
|
-
const extraRes = await dataInsert({ table: formData[key].table, data: { ...row, [formData[key].parent_id]: req.body[formData[key].parent_id] } });
|
|
47
|
-
return extraRes?.rows?.[0];
|
|
48
|
-
}));
|
|
49
|
-
Object.assign(res.extra, { [key]: extraRows.filter((el) => el) });
|
|
50
|
-
}));
|
|
51
|
-
}
|
|
52
|
-
|
|
53
|
-
return { rows: res.rows, extra: res.extra };
|
|
54
|
-
}
|
|
1
|
+
import dataInsert from '../funcs/dataInsert.js';
|
|
2
|
+
import getToken from '../funcs/getToken.js';
|
|
3
|
+
import checkXSS from './utils/checkXSS.js';
|
|
4
|
+
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
5
|
+
import getAccess from '../funcs/getAccess.js';
|
|
6
|
+
|
|
7
|
+
export default async function insert(req) {
|
|
8
|
+
const { actions = [] } = await getAccess(req, req.params.table) || {};
|
|
9
|
+
if (!actions.includes('edit')) {
|
|
10
|
+
return { message: 'access restricted', status: 403 };
|
|
11
|
+
}
|
|
12
|
+
if (!req.params?.table) {
|
|
13
|
+
return { message: 'table is required', status: 400 };
|
|
14
|
+
}
|
|
15
|
+
const loadTemplate = await getTemplate('table', req.params.table);
|
|
16
|
+
const { table, public: ispublic } = loadTemplate || req.params || {};
|
|
17
|
+
if (!table) {
|
|
18
|
+
return { message: 'table not found', status: 404 };
|
|
19
|
+
}
|
|
20
|
+
|
|
21
|
+
const { funcs = {}, user = {}, params = {} } = req;
|
|
22
|
+
const tokenDataString = await getToken({
|
|
23
|
+
funcs, uid: user.uid, token: params.table, mode: 'a', json: 0,
|
|
24
|
+
});
|
|
25
|
+
|
|
26
|
+
const { form, add } = JSON.parse(tokenDataString || '{}');
|
|
27
|
+
|
|
28
|
+
const formData = form || loadTemplate?.form ? (await getTemplate('form', form || loadTemplate?.form) || {}) : {};
|
|
29
|
+
|
|
30
|
+
const xssCheck = checkXSS({ body: req.body, schema: formData?.schema });
|
|
31
|
+
|
|
32
|
+
if (xssCheck.error && formData?.xssCheck !== false) {
|
|
33
|
+
req.log.warn({ name: 'injection/xss', msg: xssCheck.error, table }, req);
|
|
34
|
+
return { message: 'Дані містять заборонені символи. Приберіть їх та спробуйте ще раз', status: 409 };
|
|
35
|
+
}
|
|
36
|
+
|
|
37
|
+
const { uid } = funcs.config?.auth?.disable || ispublic ? { uid: '1' } : user || {};
|
|
38
|
+
Object.assign(req.body, { uid, editor_id: uid });
|
|
39
|
+
const res = await dataInsert({ table: add || table, data: req.body });
|
|
40
|
+
|
|
41
|
+
const extraKeys = Object.keys(formData)?.filter((key) => formData?.[key]?.type === 'DataTable' && formData?.[key]?.table && formData?.[key]?.parent_id && req.body[key].length);
|
|
42
|
+
if (extraKeys?.length) {
|
|
43
|
+
res.extra = {};
|
|
44
|
+
await Promise.all(extraKeys?.map(async (key) => {
|
|
45
|
+
const extraRows = await Promise.all(req.body[key].map(async (row) => {
|
|
46
|
+
const extraRes = await dataInsert({ table: formData[key].table, data: { ...row, [formData[key].parent_id]: req.body[formData[key].parent_id] } });
|
|
47
|
+
return extraRes?.rows?.[0];
|
|
48
|
+
}));
|
|
49
|
+
Object.assign(res.extra, { [key]: extraRows.filter((el) => el) });
|
|
50
|
+
}));
|
|
51
|
+
}
|
|
52
|
+
|
|
53
|
+
return { rows: res.rows, extra: res.extra };
|
|
54
|
+
}
|
|
@@ -1,59 +1,59 @@
|
|
|
1
|
-
import dataUpdate from '../funcs/dataUpdate.js';
|
|
2
|
-
import dataInsert from '../funcs/dataInsert.js';
|
|
3
|
-
import pgClients from '../../pg/pgClients.js';
|
|
4
|
-
import getToken from '../funcs/getToken.js';
|
|
5
|
-
import checkXSS from './utils/checkXSS.js';
|
|
6
|
-
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
7
|
-
import getAccess from '../funcs/getAccess.js';
|
|
8
|
-
|
|
9
|
-
export default async function update(req) {
|
|
10
|
-
const { actions = [], scope, my } = await getAccess(req, req.params.table, req.params.id) || {};
|
|
11
|
-
if (!actions.includes('edit') || (scope === 'my' && !my)) {
|
|
12
|
-
return { message: 'access restricted', status: 403 };
|
|
13
|
-
}
|
|
14
|
-
if (!req.params?.table) {
|
|
15
|
-
return { message: 'table is required', status: 400 };
|
|
16
|
-
}
|
|
17
|
-
if (!req.params?.id) {
|
|
18
|
-
return { message: 'id is required', status: 404 };
|
|
19
|
-
}
|
|
20
|
-
const loadTemplate = await getTemplate('table', req.params.table);
|
|
21
|
-
const { table, public: ispublic } = loadTemplate || req.params || {};
|
|
22
|
-
const { id } = req.params || {};
|
|
23
|
-
|
|
24
|
-
const { funcs = {}, user = {}, params = {} } = req;
|
|
25
|
-
const uid = funcs.config?.auth?.disable || ispublic ? '1' : user.uid;
|
|
26
|
-
const tokenDataString = await getToken({
|
|
27
|
-
funcs, uid, token: params.table, mode: 'w', json: 0,
|
|
28
|
-
});
|
|
29
|
-
|
|
30
|
-
const tokenData = JSON.parse(tokenDataString || '{}');
|
|
31
|
-
|
|
32
|
-
const formData = tokenData?.form || loadTemplate?.form ? await getTemplate('form', tokenData.form || loadTemplate?.form) : {};
|
|
33
|
-
|
|
34
|
-
const xssCheck = checkXSS({ body: req.body, schema: formData?.schema });
|
|
35
|
-
|
|
36
|
-
if (xssCheck.error && formData?.xssCheck !== false) {
|
|
37
|
-
req.log.warn({ name: 'injection/xss', msg: xssCheck.error, table }, req);
|
|
38
|
-
return { message: 'Дані містять заборонені символи. Приберіть їх та спробуйте ще раз', status: 409 };
|
|
39
|
-
}
|
|
40
|
-
|
|
41
|
-
const res = await dataUpdate({ table: tokenData?.table || table, id: tokenData?.id || id, data: req.body });
|
|
42
|
-
|
|
43
|
-
const extraKeys = Object.keys(formData)?.filter((key) => formData?.[key]?.type === 'DataTable' && formData?.[key]?.table && formData?.[key]?.parent_id && req.body[key].length);
|
|
44
|
-
if (extraKeys?.length) {
|
|
45
|
-
res.extra = {};
|
|
46
|
-
await Promise.all(extraKeys?.map(async (key) => {
|
|
47
|
-
// delete old extra data
|
|
48
|
-
await pgClients.client.query(`delete from ${formData[key].table} where ${formData[key].parent_id}=$1`, [req.body[formData[key].parent_id]]);
|
|
49
|
-
// insert new extra data
|
|
50
|
-
const extraRows = await Promise.all(req.body[key].map(async (row) => {
|
|
51
|
-
const extraRes = await dataInsert({ table: formData[key].table, data: { ...row, [formData[key].parent_id]: req.body[formData[key].parent_id] } });
|
|
52
|
-
return extraRes?.rows?.[0];
|
|
53
|
-
}));
|
|
54
|
-
Object.assign(res.extra, { [key]: extraRows.filter((el) => el) });
|
|
55
|
-
}));
|
|
56
|
-
}
|
|
57
|
-
|
|
58
|
-
return res;
|
|
59
|
-
}
|
|
1
|
+
import dataUpdate from '../funcs/dataUpdate.js';
|
|
2
|
+
import dataInsert from '../funcs/dataInsert.js';
|
|
3
|
+
import pgClients from '../../pg/pgClients.js';
|
|
4
|
+
import getToken from '../funcs/getToken.js';
|
|
5
|
+
import checkXSS from './utils/checkXSS.js';
|
|
6
|
+
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
7
|
+
import getAccess from '../funcs/getAccess.js';
|
|
8
|
+
|
|
9
|
+
export default async function update(req) {
|
|
10
|
+
const { actions = [], scope, my } = await getAccess(req, req.params.table, req.params.id) || {};
|
|
11
|
+
if (!actions.includes('edit') || (scope === 'my' && !my)) {
|
|
12
|
+
return { message: 'access restricted', status: 403 };
|
|
13
|
+
}
|
|
14
|
+
if (!req.params?.table) {
|
|
15
|
+
return { message: 'table is required', status: 400 };
|
|
16
|
+
}
|
|
17
|
+
if (!req.params?.id) {
|
|
18
|
+
return { message: 'id is required', status: 404 };
|
|
19
|
+
}
|
|
20
|
+
const loadTemplate = await getTemplate('table', req.params.table);
|
|
21
|
+
const { table, public: ispublic } = loadTemplate || req.params || {};
|
|
22
|
+
const { id } = req.params || {};
|
|
23
|
+
|
|
24
|
+
const { funcs = {}, user = {}, params = {} } = req;
|
|
25
|
+
const uid = funcs.config?.auth?.disable || ispublic ? '1' : user.uid;
|
|
26
|
+
const tokenDataString = await getToken({
|
|
27
|
+
funcs, uid, token: params.table, mode: 'w', json: 0,
|
|
28
|
+
});
|
|
29
|
+
|
|
30
|
+
const tokenData = JSON.parse(tokenDataString || '{}');
|
|
31
|
+
|
|
32
|
+
const formData = tokenData?.form || loadTemplate?.form ? await getTemplate('form', tokenData.form || loadTemplate?.form) : {};
|
|
33
|
+
|
|
34
|
+
const xssCheck = checkXSS({ body: req.body, schema: formData?.schema });
|
|
35
|
+
|
|
36
|
+
if (xssCheck.error && formData?.xssCheck !== false) {
|
|
37
|
+
req.log.warn({ name: 'injection/xss', msg: xssCheck.error, table }, req);
|
|
38
|
+
return { message: 'Дані містять заборонені символи. Приберіть їх та спробуйте ще раз', status: 409 };
|
|
39
|
+
}
|
|
40
|
+
|
|
41
|
+
const res = await dataUpdate({ table: tokenData?.table || table, id: tokenData?.id || id, data: req.body });
|
|
42
|
+
|
|
43
|
+
const extraKeys = Object.keys(formData)?.filter((key) => formData?.[key]?.type === 'DataTable' && formData?.[key]?.table && formData?.[key]?.parent_id && req.body[key].length);
|
|
44
|
+
if (extraKeys?.length) {
|
|
45
|
+
res.extra = {};
|
|
46
|
+
await Promise.all(extraKeys?.map(async (key) => {
|
|
47
|
+
// delete old extra data
|
|
48
|
+
await pgClients.client.query(`delete from ${formData[key].table} where ${formData[key].parent_id}=$1`, [req.body[formData[key].parent_id]]);
|
|
49
|
+
// insert new extra data
|
|
50
|
+
const extraRows = await Promise.all(req.body[key].map(async (row) => {
|
|
51
|
+
const extraRes = await dataInsert({ table: formData[key].table, data: { ...row, [formData[key].parent_id]: req.body[formData[key].parent_id] } });
|
|
52
|
+
return extraRes?.rows?.[0];
|
|
53
|
+
}));
|
|
54
|
+
Object.assign(res.extra, { [key]: extraRows.filter((el) => el) });
|
|
55
|
+
}));
|
|
56
|
+
}
|
|
57
|
+
|
|
58
|
+
return res;
|
|
59
|
+
}
|
package/crud/funcs/dataInsert.js
CHANGED
|
@@ -1,24 +1,24 @@
|
|
|
1
|
-
import getPG from '../../pg/funcs/getPG.js';
|
|
2
|
-
import getMeta from '../../pg/funcs/getMeta.js';
|
|
3
|
-
|
|
4
|
-
export default async function dataInsert({ table, data, pg: pg1 }) {
|
|
5
|
-
const pg = pg1 || getPG({ name: 'client' });
|
|
6
|
-
if (!data) return null;
|
|
7
|
-
const { columns } = await getMeta(table);
|
|
8
|
-
if (!columns) return null;
|
|
9
|
-
|
|
10
|
-
const names = columns.map((el) => el.name);
|
|
11
|
-
const filterData = Object.keys(data)
|
|
12
|
-
.filter((el) => data[el] && names.includes(el)).map((el) => [el, data[el]]);
|
|
13
|
-
|
|
14
|
-
const insertQuery = `insert into ${table}
|
|
15
|
-
|
|
16
|
-
( ${filterData?.map((key) => `"${key[0]}"`).join(',')})
|
|
17
|
-
|
|
18
|
-
values (${filterData?.map((key, i) => (key[0] === 'geom' ? `st_setsrid(st_geomfromgeojson($${i + 1}::json),4326)` : `$${i + 1}`)).join(',')})
|
|
19
|
-
|
|
20
|
-
returning *`;
|
|
21
|
-
|
|
22
|
-
const res = await pg.query(insertQuery, [...filterData.map((el) => (typeof el[1] === 'object' && (!Array.isArray(el[1]) || typeof el[1]?.[0] === 'object') ? JSON.stringify(el[1]) : el[1]))]) || {};
|
|
23
|
-
return res;
|
|
24
|
-
}
|
|
1
|
+
import getPG from '../../pg/funcs/getPG.js';
|
|
2
|
+
import getMeta from '../../pg/funcs/getMeta.js';
|
|
3
|
+
|
|
4
|
+
export default async function dataInsert({ table, data, pg: pg1 }) {
|
|
5
|
+
const pg = pg1 || getPG({ name: 'client' });
|
|
6
|
+
if (!data) return null;
|
|
7
|
+
const { columns } = await getMeta(table);
|
|
8
|
+
if (!columns) return null;
|
|
9
|
+
|
|
10
|
+
const names = columns.map((el) => el.name);
|
|
11
|
+
const filterData = Object.keys(data)
|
|
12
|
+
.filter((el) => data[el] && names.includes(el)).map((el) => [el, data[el]]);
|
|
13
|
+
|
|
14
|
+
const insertQuery = `insert into ${table}
|
|
15
|
+
|
|
16
|
+
( ${filterData?.map((key) => `"${key[0]}"`).join(',')})
|
|
17
|
+
|
|
18
|
+
values (${filterData?.map((key, i) => (key[0] === 'geom' ? `st_setsrid(st_geomfromgeojson($${i + 1}::json),4326)` : `$${i + 1}`)).join(',')})
|
|
19
|
+
|
|
20
|
+
returning *`;
|
|
21
|
+
|
|
22
|
+
const res = await pg.query(insertQuery, [...filterData.map((el) => (typeof el[1] === 'object' && (!Array.isArray(el[1]) || typeof el[1]?.[0] === 'object') ? JSON.stringify(el[1]) : el[1]))]) || {};
|
|
23
|
+
return res;
|
|
24
|
+
}
|
package/crud/funcs/getAccess.js
CHANGED
|
@@ -1,53 +1,53 @@
|
|
|
1
|
-
import getMeta from '../../pg/funcs/getMeta.js';
|
|
2
|
-
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
3
|
-
import config from '../../config.js';
|
|
4
|
-
|
|
5
|
-
const q = `select a.route_id as id, b.actions, b.scope
|
|
6
|
-
from admin.routes a
|
|
7
|
-
left join admin.access b on
|
|
8
|
-
a.route_id=b.route_id
|
|
9
|
-
left join admin.roles c on
|
|
10
|
-
b.role_id=c.role_id
|
|
11
|
-
and c.enabled
|
|
12
|
-
left join admin.user_roles d on
|
|
13
|
-
c.role_id=d.role_id
|
|
14
|
-
and ( case when
|
|
15
|
-
d.expiration is not null
|
|
16
|
-
then d.expiration > CURRENT_DATE
|
|
17
|
-
else 1=1
|
|
18
|
-
end )
|
|
19
|
-
where a.route_id=$1 and $2 in (b.user_uid, d.user_uid)`;
|
|
20
|
-
|
|
21
|
-
export default async function getAccess(req, template, id = null) {
|
|
22
|
-
if (config.disableAccessRestriction || true) {
|
|
23
|
-
return { actions: ['get', 'edit', 'del'], my: true, query: '1=1' };
|
|
24
|
-
}
|
|
25
|
-
const { pg, session = {} } = req;
|
|
26
|
-
const { uid, user_type: userType } = session.passport?.user || {};
|
|
27
|
-
if (!uid || !template) return null;
|
|
28
|
-
|
|
29
|
-
if (!pg.pk?.['admin.access']) return null;
|
|
30
|
-
|
|
31
|
-
const { table } = await getTemplate('table', template) || {};
|
|
32
|
-
if (!table) return null;
|
|
33
|
-
|
|
34
|
-
const { scope = 'my', actions = [] } = await pg.one(q, [template, uid]);
|
|
35
|
-
// console.log(scope, actions);
|
|
36
|
-
|
|
37
|
-
const { columns = [] } = await getMeta(table);
|
|
38
|
-
const columnList = columns.map((el) => el.name || el).join(',');
|
|
39
|
-
|
|
40
|
-
const query = userType?.includes('admin') ? '1=1' : {
|
|
41
|
-
my: `uid='${uid}'`,
|
|
42
|
-
responsible: columnList.includes('responsible_id')
|
|
43
|
-
? `responsible_id='${uid}'`
|
|
44
|
-
: `uid='${uid}'`,
|
|
45
|
-
all: '1=1',
|
|
46
|
-
}[scope];
|
|
47
|
-
|
|
48
|
-
const { my } = pg.pk?.[table] && id ? await pg.one(`select uid=$1 as my from ${table} where ${pg.pk?.[table]}=$2`, [uid, id]) : {};
|
|
49
|
-
|
|
50
|
-
return {
|
|
51
|
-
scope, actions, query, my,
|
|
52
|
-
};
|
|
53
|
-
}
|
|
1
|
+
import getMeta from '../../pg/funcs/getMeta.js';
|
|
2
|
+
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
3
|
+
import config from '../../config.js';
|
|
4
|
+
|
|
5
|
+
const q = `select a.route_id as id, b.actions, b.scope
|
|
6
|
+
from admin.routes a
|
|
7
|
+
left join admin.access b on
|
|
8
|
+
a.route_id=b.route_id
|
|
9
|
+
left join admin.roles c on
|
|
10
|
+
b.role_id=c.role_id
|
|
11
|
+
and c.enabled
|
|
12
|
+
left join admin.user_roles d on
|
|
13
|
+
c.role_id=d.role_id
|
|
14
|
+
and ( case when
|
|
15
|
+
d.expiration is not null
|
|
16
|
+
then d.expiration > CURRENT_DATE
|
|
17
|
+
else 1=1
|
|
18
|
+
end )
|
|
19
|
+
where a.route_id=$1 and $2 in (b.user_uid, d.user_uid)`;
|
|
20
|
+
|
|
21
|
+
export default async function getAccess(req, template, id = null) {
|
|
22
|
+
if (config.disableAccessRestriction || true) {
|
|
23
|
+
return { actions: ['get', 'edit', 'del'], my: true, query: '1=1' };
|
|
24
|
+
}
|
|
25
|
+
const { pg, session = {} } = req;
|
|
26
|
+
const { uid, user_type: userType } = session.passport?.user || {};
|
|
27
|
+
if (!uid || !template) return null;
|
|
28
|
+
|
|
29
|
+
if (!pg.pk?.['admin.access']) return null;
|
|
30
|
+
|
|
31
|
+
const { table } = await getTemplate('table', template) || {};
|
|
32
|
+
if (!table) return null;
|
|
33
|
+
|
|
34
|
+
const { scope = 'my', actions = [] } = await pg.one(q, [template, uid]);
|
|
35
|
+
// console.log(scope, actions);
|
|
36
|
+
|
|
37
|
+
const { columns = [] } = await getMeta(table);
|
|
38
|
+
const columnList = columns.map((el) => el.name || el).join(',');
|
|
39
|
+
|
|
40
|
+
const query = userType?.includes('admin') ? '1=1' : {
|
|
41
|
+
my: `uid='${uid}'`,
|
|
42
|
+
responsible: columnList.includes('responsible_id')
|
|
43
|
+
? `responsible_id='${uid}'`
|
|
44
|
+
: `uid='${uid}'`,
|
|
45
|
+
all: '1=1',
|
|
46
|
+
}[scope];
|
|
47
|
+
|
|
48
|
+
const { my } = pg.pk?.[table] && id ? await pg.one(`select uid=$1 as my from ${table} where ${pg.pk?.[table]}=$2`, [uid, id]) : {};
|
|
49
|
+
|
|
50
|
+
return {
|
|
51
|
+
scope, actions, query, my,
|
|
52
|
+
};
|
|
53
|
+
}
|
package/crud/funcs/getOpt.js
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
|
-
import getRedis from '../../redis/funcs/getRedis.js';
|
|
2
|
-
|
|
3
|
-
export default async function getOpt(token, funcs) {
|
|
4
|
-
const rclient = getRedis({ db: 0, funcs });
|
|
5
|
-
|
|
6
|
-
const key = `opt:${token}`;
|
|
7
|
-
const data = await rclient.get(key);
|
|
8
|
-
if (!data) return null;
|
|
9
|
-
return JSON.parse(data);
|
|
10
|
-
}
|
|
1
|
+
import getRedis from '../../redis/funcs/getRedis.js';
|
|
2
|
+
|
|
3
|
+
export default async function getOpt(token, funcs) {
|
|
4
|
+
const rclient = getRedis({ db: 0, funcs });
|
|
5
|
+
|
|
6
|
+
const key = `opt:${token}`;
|
|
7
|
+
const data = await rclient.get(key);
|
|
8
|
+
if (!data) return null;
|
|
9
|
+
return JSON.parse(data);
|
|
10
|
+
}
|
package/crud/funcs/setOpt.js
CHANGED
|
@@ -1,16 +1,16 @@
|
|
|
1
|
-
import { createHash } from 'crypto';
|
|
2
|
-
import getRedis from '../../redis/funcs/getRedis.js';
|
|
3
|
-
|
|
4
|
-
function md5(string) {
|
|
5
|
-
return createHash('md5').update(string).digest('hex');
|
|
6
|
-
}
|
|
7
|
-
|
|
8
|
-
export default async function setOpt(params) {
|
|
9
|
-
const token = Buffer.from(md5(typeof params === 'object' ? JSON.stringify(params) : params), 'hex').toString('base64').replace(/[+-=]+/g, '');
|
|
10
|
-
// const token = md5(params);
|
|
11
|
-
const key = `opt:${token}`;
|
|
12
|
-
|
|
13
|
-
const rclient = getRedis({ db: 0, funcs: params.funcs });
|
|
14
|
-
await rclient.set(key, JSON.stringify(params), 'EX', 60 * 60);
|
|
15
|
-
return token;
|
|
16
|
-
}
|
|
1
|
+
import { createHash } from 'crypto';
|
|
2
|
+
import getRedis from '../../redis/funcs/getRedis.js';
|
|
3
|
+
|
|
4
|
+
function md5(string) {
|
|
5
|
+
return createHash('md5').update(string).digest('hex');
|
|
6
|
+
}
|
|
7
|
+
|
|
8
|
+
export default async function setOpt(params) {
|
|
9
|
+
const token = Buffer.from(md5(typeof params === 'object' ? JSON.stringify(params) : params), 'hex').toString('base64').replace(/[+-=]+/g, '');
|
|
10
|
+
// const token = md5(params);
|
|
11
|
+
const key = `opt:${token}`;
|
|
12
|
+
|
|
13
|
+
const rclient = getRedis({ db: 0, funcs: params.funcs });
|
|
14
|
+
await rclient.set(key, JSON.stringify(params), 'EX', 60 * 60);
|
|
15
|
+
return token;
|
|
16
|
+
}
|
package/helper.js
CHANGED
|
@@ -1,28 +1,28 @@
|
|
|
1
|
-
// This file contains code that we reuse
|
|
2
|
-
// between our tests.
|
|
3
|
-
import Fastify from 'fastify';
|
|
4
|
-
import config from './test/config.js';
|
|
5
|
-
import appService from './index.js';
|
|
6
|
-
|
|
7
|
-
import rclient from './redis/client.js';
|
|
8
|
-
import pgClients from './pg/pgClients.js';
|
|
9
|
-
|
|
10
|
-
// automatically build and tear down our instance
|
|
11
|
-
async function build(t) {
|
|
12
|
-
// you can set all the options supported by the fastify CLI command
|
|
13
|
-
// const argv = [AppPath]
|
|
14
|
-
process.env.NODE_ENV = 'production';
|
|
15
|
-
const app = Fastify({ logger: false });
|
|
16
|
-
app.register(appService, config);
|
|
17
|
-
// close the app after we are done
|
|
18
|
-
t.after(() => {
|
|
19
|
-
// console.log('close app');
|
|
20
|
-
pgClients.client.end();
|
|
21
|
-
rclient.quit();
|
|
22
|
-
app.close();
|
|
23
|
-
});
|
|
24
|
-
|
|
25
|
-
return app;
|
|
26
|
-
}
|
|
27
|
-
|
|
28
|
-
export default build;
|
|
1
|
+
// This file contains code that we reuse
|
|
2
|
+
// between our tests.
|
|
3
|
+
import Fastify from 'fastify';
|
|
4
|
+
import config from './test/config.js';
|
|
5
|
+
import appService from './index.js';
|
|
6
|
+
|
|
7
|
+
import rclient from './redis/client.js';
|
|
8
|
+
import pgClients from './pg/pgClients.js';
|
|
9
|
+
|
|
10
|
+
// automatically build and tear down our instance
|
|
11
|
+
async function build(t) {
|
|
12
|
+
// you can set all the options supported by the fastify CLI command
|
|
13
|
+
// const argv = [AppPath]
|
|
14
|
+
process.env.NODE_ENV = 'production';
|
|
15
|
+
const app = Fastify({ logger: false });
|
|
16
|
+
app.register(appService, config);
|
|
17
|
+
// close the app after we are done
|
|
18
|
+
t.after(() => {
|
|
19
|
+
// console.log('close app');
|
|
20
|
+
pgClients.client.end();
|
|
21
|
+
rclient.quit();
|
|
22
|
+
app.close();
|
|
23
|
+
});
|
|
24
|
+
|
|
25
|
+
return app;
|
|
26
|
+
}
|
|
27
|
+
|
|
28
|
+
export default build;
|
|
@@ -1,19 +1,19 @@
|
|
|
1
|
-
export default async function userNotifications({
|
|
2
|
-
pg, session = {}, query = {},
|
|
3
|
-
}) {
|
|
4
|
-
const time = Date.now();
|
|
5
|
-
try {
|
|
6
|
-
const { uid } = session.passport?.user || {};
|
|
7
|
-
if (!uid) return { error: 'access restricted', status: 403 };
|
|
8
|
-
|
|
9
|
-
const queryFunc = query.nocache ? pg.query : pg.queryCache;
|
|
10
|
-
|
|
11
|
-
// queryCache not supports $1 params
|
|
12
|
-
const { rows } = await queryFunc(`select notification_id as id, notification_type as type,
|
|
13
|
-
notification_status as status, title, body, link, uid from crm.notification where uid='${uid}'`);
|
|
14
|
-
return { time: Date.now() - time, total: rows?.length, rows };
|
|
15
|
-
}
|
|
16
|
-
catch (err) {
|
|
17
|
-
return { error: err.toString(), status: 500 };
|
|
18
|
-
}
|
|
19
|
-
}
|
|
1
|
+
export default async function userNotifications({
|
|
2
|
+
pg, session = {}, query = {},
|
|
3
|
+
}) {
|
|
4
|
+
const time = Date.now();
|
|
5
|
+
try {
|
|
6
|
+
const { uid } = session.passport?.user || {};
|
|
7
|
+
if (!uid) return { error: 'access restricted', status: 403 };
|
|
8
|
+
|
|
9
|
+
const queryFunc = query.nocache ? pg.query : pg.queryCache;
|
|
10
|
+
|
|
11
|
+
// queryCache not supports $1 params
|
|
12
|
+
const { rows } = await queryFunc(`select notification_id as id, notification_type as type,
|
|
13
|
+
notification_status as status, title, body, link, uid from crm.notification where uid='${uid}'`);
|
|
14
|
+
return { time: Date.now() - time, total: rows?.length, rows };
|
|
15
|
+
}
|
|
16
|
+
catch (err) {
|
|
17
|
+
return { error: err.toString(), status: 500 };
|
|
18
|
+
}
|
|
19
|
+
}
|
|
@@ -1,8 +1,8 @@
|
|
|
1
|
-
export default async function addNotification({
|
|
2
|
-
pg, session = {}, title, body, link, notificationType, uid: uid1,
|
|
3
|
-
}) {
|
|
4
|
-
const uid = uid1 || session.passport?.user?.uid || {};
|
|
5
|
-
const { id, status } = await pg.one(`insert into crm.notification(title, body, link, notification_type, uid)
|
|
6
|
-
values($1,$2,$3,$4,$5) returning notification_id as id, notification_status as status`, [title, body, link, notificationType, uid]);
|
|
7
|
-
return { id, status };
|
|
8
|
-
}
|
|
1
|
+
export default async function addNotification({
|
|
2
|
+
pg, session = {}, title, body, link, notificationType, uid: uid1,
|
|
3
|
+
}) {
|
|
4
|
+
const uid = uid1 || session.passport?.user?.uid || {};
|
|
5
|
+
const { id, status } = await pg.one(`insert into crm.notification(title, body, link, notification_type, uid)
|
|
6
|
+
values($1,$2,$3,$4,$5) returning notification_id as id, notification_status as status`, [title, body, link, notificationType, uid]);
|
|
7
|
+
return { id, status };
|
|
8
|
+
}
|