@opengis/fastify-table 1.1.120 → 1.1.122

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "1.1.120",
+  "version": "1.1.122",
   "type": "module",
   "description": "core-plugins",
   "keywords": ["fastify", "table", "crud", "pg", "backend" ],

package/server/plugins/pg/funcs/getMeta.js

@@ -9,18 +9,19 @@ export default async function getMeta(opt) {
 
   if (data[table]) return data[table];
 
-  if (!pg.tlist?.includes(table)) {
+  if (!pg.tlist?.includes(table.replace(/"/g, ''))) {
     return { error: `${table} - not found`, status: 400 };
   }
 
-  const { fields } = await pg.query(`select * from ${table} where $1=$1 limit 0`, [1]);
-  const pks1 = await pg.query(`SELECT json_object_agg(c.conrelid::regclass, a.attname) as pks1 FROM pg_constraint c 
-  left join pg_attribute a on c.conrelid=a.attrelid and a.attnum = c.conkey[1] WHERE c.contype='p'::"char" and c.conrelid::regclass = $1::regclass`, [table])
-    .then(el => el.rows[0]?.pks1 || {});
+  const { fields = [] } = await pg.query(`select * from ${table} limit 0`);
+  const { pks1 = {} } = await pg.query(`SELECT json_object_agg(c.conrelid::regclass, a.attname) as pks1 
+  FROM pg_constraint c 
+    left join pg_attribute a on c.conrelid=a.attrelid and a.attnum = c.conkey[1] 
+  WHERE c.contype='p'::"char" and c.conrelid::regclass = $1::regclass`, [table]).then(el => el.rows?.[0] || {});
 
   const pk = table.startsWith('public.') ? pks1[table.replace('public.', '')] : pks1[table];
 
-  const geomAttr = fields.find((el) => pg.pgType[el.dataTypeID] === 'geometry')?.name; // change geometry text to geometry code
+  const geomAttr = fields.find((el) => pg.pgType?.[el.dataTypeID] === 'geometry')?.name; // change geometry text to geometry code
 
   const res = {
     pk, columns: fields, geom: geomAttr, view: pg.relkinds?.[table] === 'v',

package/server/plugins/policy/funcs/checkPolicy.js

@@ -1,4 +1,4 @@
-import { config } from '@opengis/fastify-table/utils.js';
+import { config, logger } from '@opengis/fastify-table/utils.js';
 import block from '../sqlInjection.js';
 
 /**
@@ -13,27 +13,29 @@ import block from '../sqlInjection.js';
 
 export default function checkPolicy(req) {
   const {
-    originalUrl: path, hostname, query, params, headers: hs, log, sid = 35,
+    originalUrl: path, hostname, query, params, headers, method, session, routeOptions,
   } = req;
-  const user = req.user || req.session?.passport?.user;
+  const body = JSON.stringify(req?.body || {}).substring(30);
+  const isAdmin = process.env.NODE_ENV === 'admin' || hostname.split(':').shift() === config.adminDomain || hostname.startsWith('admin');
+  const user = req.user || session?.passport?.user;
 
   const isUser = config?.debug || !!user;
 
   const isServer = process.argv[2];
-  const { policy = [] } = req.routeOptions?.config || {};
+  const { policy = [] } = routeOptions?.config || {};
 
   /*= == 0.Check superadmin access  === */
   if (policy.includes('superadmin') && user?.user_type !== 'superadmin') {
-    log.warn('api/superadmin', {
-      path, params, query, body: JSON.stringify(req?.body || {}).substring(30), message: 'access restricted: 0',
+    logger.file('access', {
+      path, method, params, query, body, message: 'access restricted: not superadmin', uid: user?.uid,
     });
     return { message: 'access restricted: 0', status: 403 };
   }
 
   /*= == 1.File injection  === */
   if (JSON.stringify(params || {})?.includes('../') || JSON.stringify(query || {})?.includes('../') || path?.includes('../')) {
-    log.warn('injection/file', {
-      path, params, query, message: 'access restricted: 1',
+    logger.file('injection/file', {
+      path, method, params, query, body, message: 'access restricted: 1', uid: user?.uid,
     });
     return { message: 'access restricted: 1', status: 403 };
   }
@@ -48,7 +50,9 @@ export default function checkPolicy(req) {
     // skip polyline param - data filter (geometry bounds)
     const stopWords = block.filter((el) => path.replace(query.polyline, '').includes(el));
     if (stopWords?.length) {
-      log.warn('injection/sql', { stopWords, message: 'access restricted: 2', path });
+      logger.file('injection/sql', {
+        path, method, params, query, body, stopWords, message: 'access restricted: 2', uid: user?.uid,
+      });
       return { message: 'access restricted: 2', status: 403 };
     }
   }
@@ -65,26 +69,35 @@ export default function checkPolicy(req) {
 
   /* === 3. policy: user === */
   if (!user && policy.includes('user') && false) {
-    log.warn('policy/user', { message: 'access restricted: 3', path });
+    logger.file('policy/user', {
+      path, method, params, query, body, message: 'access restricted: 3',
+    });
     return { message: 'access restricted: 3', status: 403 };
   }
 
   /* === 4. policy: referer === */
-  if (!hs?.referer?.includes?.(hostname) && policy.includes('referer') && !config.local && !config.debug) {
-    log.warn('policy/referer', { message: 'access restricted: 4', uid: user?.uid });
+  if (!headers?.referer?.includes?.(hostname) && policy.includes('referer') && !config.local && !config.debug) {
+    logger.file('policy/referer', {
+      path, method, params, query, body, message: 'access restricted: 4', uid: user?.uid,
+    });
     return { message: 'access restricted: 4', status: 403 };
   }
 
   /* === 5. policy: site auth === */
-  if (!policy.includes('site') && sid === 1 && isUser && !config.local && !config.debug) {
-    log.warn('policy/site', { message: 'access restricted: 5', path, uid: user?.uid });
+  if (!policy.includes('site') && !isAdmin && !config.local && !config.debug
+  && !['/auth/redirect', `${config.prefix || '/api'}/login`].find(el => path.includes(el))) {
+    logger.file('policy/site', {
+      path, method, params, query, body, message: 'access restricted: 5', uid: user?.uid,
+    });
     return { message: 'access restricted: 5', status: 403 };
   }
 
   /* === 6. base policy: block api, except login  === */
-  if (sid === 35 && !isUser && isServer && !config.local && !config.debug
+  if (isAdmin && !isUser && isServer && !config.local && !config.debug
     && !path.startsWith(`${config.prefix || '/api'}/login`)) {
-    log.warn('policy/api', { message: 'access restricted: 6', path, uid: user?.uid });
+    logger.file('policy/api', {
+      path, method, params, query, body, message: 'access restricted: 6', uid: user?.uid,
+    });
     return { message: 'access restricted: 6', status: 403 };
   }