@opengis/fastify-table 1.1.119 → 1.1.121

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "1.1.119",
+  "version": "1.1.121",
   "type": "module",
   "description": "core-plugins",
   "keywords": ["fastify", "table", "crud", "pg", "backend" ],

package/server/plugins/policy/funcs/checkPolicy.js

@@ -1,4 +1,4 @@
-import { config } from '@opengis/fastify-table/utils.js';
+import { config, logger } from '@opengis/fastify-table/utils.js';
 import block from '../sqlInjection.js';
 
 /**
@@ -13,8 +13,9 @@ import block from '../sqlInjection.js';
 
 export default function checkPolicy(req) {
   const {
-    originalUrl: path, hostname, query, params, headers: hs, log, sid = 35,
+    originalUrl: path, hostname, query, params, headers, method,
   } = req;
+  const isAdmin = process.env.NODE_ENV === 'admin';
   const user = req.user || req.session?.passport?.user;
 
   const isUser = config?.debug || !!user;
@@ -24,16 +25,16 @@ export default function checkPolicy(req) {
 
   /*= == 0.Check superadmin access  === */
   if (policy.includes('superadmin') && user?.user_type !== 'superadmin') {
-    log.warn('api/superadmin', {
-      path, params, query, body: JSON.stringify(req?.body || {}).substring(30), message: 'access restricted: 0',
+    logger.file('access', {
+      path, method, params, query, body: JSON.stringify(req?.body || {}).substring(30), message: 'access restricted: not superadmin', uid: user?.uid,
     });
     return { message: 'access restricted: 0', status: 403 };
   }
 
   /*= == 1.File injection  === */
   if (JSON.stringify(params || {})?.includes('../') || JSON.stringify(query || {})?.includes('../') || path?.includes('../')) {
-    log.warn('injection/file', {
-      path, params, query, message: 'access restricted: 1',
+    logger.file('injection/file', {
+      path, method, params, query, message: 'access restricted: 1', uid: user?.uid,
     });
     return { message: 'access restricted: 1', status: 403 };
   }
@@ -48,7 +49,9 @@ export default function checkPolicy(req) {
     // skip polyline param - data filter (geometry bounds)
     const stopWords = block.filter((el) => path.replace(query.polyline, '').includes(el));
     if (stopWords?.length) {
-      log.warn('injection/sql', { stopWords, message: 'access restricted: 2', path });
+      logger.file('injection/sql', {
+        path, method, stopWords, message: 'access restricted: 2', uid: user?.uid,
+      });
       return { message: 'access restricted: 2', status: 403 };
     }
   }
@@ -65,26 +68,33 @@ export default function checkPolicy(req) {
 
   /* === 3. policy: user === */
   if (!user && policy.includes('user') && false) {
-    log.warn('policy/user', { message: 'access restricted: 3', path });
+    logger.file('policy/user', { path, method, message: 'access restricted: 3' });
     return { message: 'access restricted: 3', status: 403 };
   }
 
   /* === 4. policy: referer === */
-  if (!hs?.referer?.includes?.(hostname) && policy.includes('referer') && !config.local && !config.debug) {
-    log.warn('policy/referer', { message: 'access restricted: 4', uid: user?.uid });
+  if (!headers?.referer?.includes?.(hostname) && policy.includes('referer') && !config.local && !config.debug) {
+    logger.file('policy/referer', {
+      path, method, message: 'access restricted: 4', uid: user?.uid,
+    });
     return { message: 'access restricted: 4', status: 403 };
   }
 
   /* === 5. policy: site auth === */
-  if (!policy.includes('site') && sid === 1 && isUser && !config.local && !config.debug) {
-    log.warn('policy/site', { message: 'access restricted: 5', path, uid: user?.uid });
+  if (!policy.includes('site') && !isAdmin && !config.local && !config.debug
+  && !['/auth/redirect', `${config.prefix || '/api'}/login`].find(el => path.includes(el))) {
+    logger.file('policy/site', {
+      path, method, message: 'access restricted: 5', uid: user?.uid,
+    });
     return { message: 'access restricted: 5', status: 403 };
   }
 
   /* === 6. base policy: block api, except login  === */
-  if (sid === 35 && !isUser && isServer && !config.local && !config.debug
+  if (isAdmin && !isUser && isServer && !config.local && !config.debug
     && !path.startsWith(`${config.prefix || '/api'}/login`)) {
-    log.warn('policy/api', { message: 'access restricted: 6', path, uid: user?.uid });
+    logger.file('policy/api', {
+      path, method, message: 'access restricted: 6', uid: user?.uid,
+    });
     return { message: 'access restricted: 6', status: 403 };
   }
 

package/server/routes/cron/controllers/cronApi.js

@@ -5,7 +5,7 @@ export default async function cronApi(req) {
     params = {}, user = {}, hostname,
   } = req;
 
-  if ((!user.uid || !user.user_type?.includes('admin')) && !hostname?.includes('localhost')) {
+  if ((!user.uid || !user.user_type?.includes('admin')) && !hostname?.includes('local')) {
     return { message: 'access restricted', status: 403 };
   }
 

package/server/routes/table/controllers/data.js

@@ -106,28 +106,36 @@ export default async function dataAPI(req) {
                      where ${where.join(' and ') || 'true'} 
                      ${order} ${offset}  limit ${limit}`
     .replace(/{{uid}}/g, uid);
-  
+
   // if (user?.user_type === 'superadmin') console.log(q);
 
   if (query.sql === '1') { return q; }
 
   const { rows } = await pg.query(q, (hookData?.id || params.id ? [hookData?.id || params.id] : null) || (query.key && loadTable.key ? [query.key] : []));
 
-  const filterWhere = [fData.q, search, bbox, queryPolyline, interfaceQuery].filter((el) => el);
+  const filterWhere = [fData.q, search, bbox, queryPolyline, interfaceQuery, loadTable.query].filter((el) => el);
 
+  const aggregates = dbColumns.map((el) => ({ name: el.name, type: pg.pgType[el.dataTypeID] })).filter((el) => ['numeric', 'double precision'].includes(el.type));
   const qCount = `select 
             count(*)::int as total,  
-            count(*) FILTER(WHERE ${filterWhere.filter(el => el).join(' and ') || 'true'})::int as filtered 
+            count(*) FILTER(WHERE ${filterWhere.join(' and ') || 'true'})::int as filtered
+            ${aggregates.length ? `,${aggregates.map((el) => `sum(${el.name}) FILTER(WHERE ${filterWhere.join(' and ') || 'true'}) as ${el.name}`).join(',')}` : ''}
             from ${table} t ${sqlTable} 
             where ${[loadTable.query, accessQuery].filter(el => el).join(' and ') || 'true'} `
     .replace(/{{uid}}/g, uid);
 
-  const { total, filtered } = keyQuery || hookData?.id || params.id ? rows.length
-    : await pg.queryCache(qCount, { table: loadTable.table, time: 5 }).then((el) => el?.rows[0]);
+  if (query.sql === '2') { return qCount; }
+
+  const counts = keyQuery || hookData?.id || params.id
+    ? { total: rows.length, filtered: rows.length }
+    : await pg.queryCache(qCount, { table: loadTable.table, time: 5 }).then(el => el?.rows[0] || {});
+
+  const { total, filtered } = counts;
+  const agg = Object.keys(counts).filter(el => !['total', 'filtered'].includes(el)).reduce((acc, el) => ({ ...acc, [el]: counts[el] }), {});
 
   await metaFormat({ rows, table: hookData?.table || params.table });
   const res = {
-    time: Date.now() - time, public: ispublic, card: loadTable.card, actions, total, filtered, count: rows.length, pk, form, rows, meta, columns, filters,
+    time: Date.now() - time, public: ispublic, card: loadTable.card, actions, total, filtered, count: rows.length, pk, form, agg, rows, meta, columns, filters,
   };
 
   // console.log({ add: loadTable.table, form: loadTable.form });