@opengis/fastify-table 1.1.77 → 1.1.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "1.1.77",
+  "version": "1.1.78",
   "type": "module",
   "description": "core-plugins",
   "main": "index.js",

package/server/plugins/crud/funcs/dataInsert.js

@@ -14,14 +14,18 @@ export default async function dataInsert({
   if (!columns) return null;
 
   const names = columns.map((el) => el.name);
+
+  Object.assign(data, { uid, editor_id: uid });
+  const systemColumns = ['cdate', 'editor_date'].filter((el) => names.includes(el)).map((el) => [el, 'now()']);
+
   const filterData = Object.keys(data)
-    .filter((el) => data[el] && names.includes(el)).map((el) => [el, data[el]]);
+    .filter((el) => !['cdate', 'editor_date'].includes(el) && data[el] && names.includes(el)).map((el) => [el, data[el]]);
 
   const insertQuery = `insert into ${table}
 
-    ( ${filterData?.map((key) => `"${key[0]}"`).join(',')}) 
+    ( ${filterData?.map((key) => `"${key[0]}"`).concat(systemColumns.map((el) => el[0])).join(',')}) 
 
-    values  (${filterData?.map((key, i) => (key[0] === 'geom' ? `st_setsrid(st_geomfromgeojson($${i + 1}::json),4326)` : `$${i + 1}`)).join(',')}) 
+    values  (${filterData?.map((key, i) => (key[0] === 'geom' ? `st_setsrid(st_geomfromgeojson($${i + 1}::json),4326)` : `$${i + 1}`)).concat(systemColumns.map((el) => el[1])).join(',')}) 
     
     returning *`;
 

package/server/plugins/crud/funcs/dataUpdate.js

@@ -16,11 +16,11 @@ export default async function dataUpdate({
   const { columns, pk } = await getMeta(table);
 
   const names = columns?.map((el) => el.name);
-  Object.assign(data, { editor_id: uid });
+
   const filterData = Object.keys(data)
-    .filter((el) => (/* typeof data[el] === 'boolean' ? true : data[el] &&  */ names?.includes(el) && el !== 'editor_date'));
+    .filter((el) => (/* typeof data[el] === 'boolean' ? true : data[el] &&  */ names?.includes(el) && !['editor_date', 'editor_id'].includes(el)));
 
-  const editorDate = names?.includes('editor_date') ? 'editor_date=now(),' : '';
+  const systemColumns = [['editor_date', 'now()'], ['editor_id', `'${uid.replace(/'/g, "''")}'`]].filter((el) => names.includes(el[0])).map((el) => `${el[0]} = ${el[1]}`).join(',');
 
   const filterValue = filterData.map((el) => [el, data[el]]).map((el) => (typeof el[1] === 'object' && el[1] && (!Array.isArray(el[1]) || typeof el[1]?.[0] === 'object') ? JSON.stringify(el[1]) : el[1]));
 
@@ -34,7 +34,7 @@ export default async function dataUpdate({
     Object.assign(srids, srids1);
   }
 
-  const updateQuery = `UPDATE ${table} SET ${editorDate} ${filterData
+  const updateQuery = `UPDATE ${table} SET ${systemColumns}, ${filterData
     ?.map((key, i) => (key?.includes('geom') && key !== 'geom' ? `"${key}"=st_setsrid(st_geomfromgeojson($${i + 2}::json),${srids[table]?.[key] || 4326})` : undefined)
       || (key === 'geom' ? `"${key}"=st_setsrid(st_geomfromgeojson($${i + 2}::json),4326)` : `"${key}"=$${i + 2}`))
     .join(',')} 

package/server/plugins/policy/funcs/checkXSS.js

@@ -13,7 +13,7 @@ function checkXSS({ body, schema = {} }) {
   // escape arrows on non-RTE
   Object.keys(body)
     .filter((key) => ['<', '>'].find((el) => body[key]?.includes?.(el))
-  && !['Summernote', 'Tiny', 'Ace'].includes(schema?.[key]?.type))
+  && !['Summernote', 'Tiny', 'Ace', 'Texteditor'].includes(schema?.[key]?.type))
     ?.forEach((key) => {
       Object.assign(body, { [key]: body[key].replace(/</g, '&lt;').replace(/>/g, '&gt;') });
     });

package/server/routes/crud/controllers/insert.js

@@ -34,8 +34,9 @@ export default async function insert(req) {
   }
 
   const formData = form || loadTemplate?.form ? (await getTemplate('form', form || loadTemplate?.form) || {}) : {};
+  const schema = formData?.schema || formData;
 
-  const xssCheck = checkXSS({ body, schema: formData?.schema || formData });
+  const xssCheck = checkXSS({ body, schema });
 
   if (xssCheck.error && formData?.xssCheck !== false) {
     req.log.warn({ name: 'injection/xss', msg: xssCheck.error, table }, req);
@@ -60,14 +61,14 @@ export default async function insert(req) {
     table, body, payload: res, user,
   });
   // form DataTable
-  const extraKeys = Object.keys(formData)?.filter((key) => formData?.[key]?.type === 'DataTable' && formData?.[key]?.table && formData?.[key]?.parent_id && body[key].length);
+  const extraKeys = Object.keys(schema || {})?.filter((key) => schema?.[key]?.type === 'DataTable' && schema?.[key]?.table && schema?.[key]?.parent_id && body[key].length);
   if (extraKeys?.length) {
     res.extra = {};
     await Promise.all(extraKeys?.map(async (key) => {
-      const objId = body[formData[key].parent_id] || req.body?.id;
+      const objId = body[schema[key].parent_id] || req.body?.id || res?.rows?.[0]?.[schema[key].parent_id];
       const extraRows = await Promise.all(body[key].map(async (row) => {
         const extraRes = await dataInsert({
-          table: formData[key].table, data: { ...row, [formData[key].parent_id]: objId }, uid: user?.uid,
+          table: schema[key].table, data: { ...row, [schema[key].parent_id]: objId }, uid: user?.uid,
         });
         return extraRes?.rows?.[0];
       }));

package/server/routes/crud/controllers/table.js

@@ -47,7 +47,9 @@ export default async function tableAPI(req) {
   if (!pk) return { message: `table not found: ${table}`, status: 404 };
 
   // const cols = columns.map((el) => el.name || el).join(',');
-  const schema = await getTemplate('form', hookData?.form || form) || {};
+  const formName = hookData?.form || tokenData?.form || form;
+  const formData = await getTemplate('form', formName) || {};
+  const schema = formData?.schema || formData;
   // skip DataTable from another table
   const extraKeys = Object.keys(schema)?.filter((key) => schema[key]?.type === 'DataTable' && schema[key]?.table && schema[key]?.parent_id && schema[key]?.colModel?.length);
   // skip non-existing columns
@@ -69,11 +71,13 @@ export default async function tableAPI(req) {
   if (extraKeys?.length) {
     await Promise.all(extraKeys?.map(async (key) => {
       const { colModel, table: extraTable, parent_id: parentId } = schema[key];
-      const { rows: extraRows } = await pg.query(`select ${parentId} as parent, ${colModel.map((col) => col.name).join(',')} from ${extraTable} a where ${parentId}=$1`, [hookData?.id || params?.id]);
+      const q1 = `select ${parentId} as parent, ${colModel.map((col) => col.name || col.key).join(',')} from ${extraTable} a where ${parentId}=$1`;
+      // console.log(tableName, formName, q1);
+      const { rows: extraRows } = await pg.query(q1, [hookData?.id || tokenData?.id || params?.id]);
       Object.assign(data, { [key]: extraRows });
     }));
   }
-  if (user.uid) {
+  if (user?.uid) {
     data.token = tokenData?.table ? params.table : setToken({
       ids: [JSON.stringify({ id, table: tableName, form: loadTable.form })],
       uid: user.uid,

package/server/routes/crud/controllers/update.js

@@ -43,8 +43,9 @@ export default async function update(req) {
   const uid = user?.uid;
 
   const formData = form || loadTemplate?.form ? await getTemplate('form', form || loadTemplate?.form) : {};
+  const schema = formData?.schema || formData;
 
-  const xssCheck = checkXSS({ body, schema: formData?.schema || formData });
+  const xssCheck = checkXSS({ body, schema });
 
   if (xssCheck.error && formData?.xssCheck !== false) {
     logger.warn({ name: 'injection/xss', msg: xssCheck.error, table }, req);
@@ -61,16 +62,16 @@ export default async function update(req) {
   });
 
   // form DataTable
-  const extraKeys = formData ? Object.keys(formData)?.filter((key) => formData?.[key]?.type === 'DataTable' && formData?.[key]?.table && formData?.[key]?.parent_id && body[key].length) : [];
+  const extraKeys = Object.keys(schema || {})?.filter((key) => schema?.[key]?.type === 'DataTable' && schema?.[key]?.table && schema?.[key]?.parent_id && body[key].length);
   if (extraKeys?.length) {
     res.extra = {};
     await Promise.all(extraKeys?.map(async (key) => {
-      const objId = body[formData[key].parent_id] || body?.id;
+      const objId = body[schema[key].parent_id] || body?.id || res?.[schema[key]?.parent_id];
       // delete old extra data
-      await pgClients.client.query(`delete from ${formData[key].table} where ${formData[key].parent_id}=$1`, [objId]); // rewrite?
+      await pgClients.client.query(`delete from ${schema[key].table} where ${schema[key].parent_id}=$1`, [objId]); // rewrite?
       // insert new extra data
       const extraRows = await Promise.all(body[key].map(async (row) => {
-        const extraRes = await dataInsert({ table: formData[key].table, data: { ...row, [formData[key].parent_id]: objId }, uid });
+        const extraRes = await dataInsert({ table: schema[key].table, data: { ...row, [schema[key].parent_id]: objId }, uid });
         return extraRes?.rows?.[0];
       }));
       Object.assign(res.extra, { [key]: extraRows.filter((el) => el) });