@opengis/fastify-table 1.1.112 → 1.1.113

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/package.json +1 -1
  2. package/server/plugins/crud/funcs/getAccess.js +7 -2
  3. package/server/routes/crud/controllers/update.js +3 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@opengis/fastify-table",
3
- "version": "1.1.112",
3
+ "version": "1.1.113",
4
4
  "type": "module",
5
5
  "description": "core-plugins",
6
6
  "main": "index.js",
package/server/plugins/crud/funcs/getAccess.js CHANGED
@@ -27,6 +27,11 @@ export default async function getAccess({ table, user = {} }) {
27
27
  if (hookData) return hookData;
28
28
 
29
29
  const { uid, user_type: userType } = user;
30
+
31
+ if (config.auth?.disable || userType?.includes?.('admin')) {
32
+ return { actions: ['view', 'edit', 'add', 'del'], query: '1=1' };
33
+ }
34
+
30
35
  const body = await getTemplate('table', table) || {};
31
36
 
32
37
  if (body.access === 'admin' && !userType?.includes?.('admin')) {
@@ -37,8 +42,8 @@ export default async function getAccess({ table, user = {} }) {
37
42
 
38
43
  const actions = uid ? ['view'].concat(body.actions || body.action_default || []) : [];
39
44
 
40
- if (config.auth?.disable || userType?.includes?.('admin') || body?.public || body.access === 'public') {
41
- return { actions: ['view', 'edit', 'add', 'del'], query: '1=1' };
45
+ if (body?.public || body.access === 'public') {
46
+ return { actions, query: '1=1' };
42
47
  }
43
48
 
44
49
  const dbTable = pgClients.client?.pk?.[table] ? table : body?.table;
package/server/routes/crud/controllers/update.js CHANGED
@@ -45,6 +45,9 @@ export default async function update(req) {
45
45
  const formData = form || loadTemplate?.form ? await getTemplate('form', form || loadTemplate?.form) : {};
46
46
  const schema = formData?.schema || formData;
47
47
 
48
+ // skip non-present fields in form schema
49
+ Object.keys(body).filter(key => !Object.keys(schema || {}).includes(key)).forEach(key => delete body[key]);
50
+
48
51
  const xssCheck = checkXSS({ body, schema });
49
52
 
50
53
  if (xssCheck.error && formData?.xssCheck !== false) {