@opengis/fastify-table 1.3.66 → 1.3.68

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "1.3.66",
+  "version": "1.3.68",
   "type": "module",
   "description": "core-plugins",
   "keywords": [

package/server/plugins/crud/funcs/validateData.js

@@ -3,8 +3,25 @@ import config from '../../../../config.js';
 const emailReg = /(?:[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?|\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-zA-Z0-9-]*[a-zA-Z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])/g;
 
 function checkField(key, val, options, idx, body) {
+    const type = options?.type?.toLowerCase?.();
+    const isrequired = options?.validators?.includes?.('required');
+
     // validators: [required]
-    if (options?.validators?.includes('required') && !val) {
+    if (type === 'switcher') {
+        // skip nulls at non-required switchers, restrict invalid values
+        if (val && typeof val !== 'boolean') {
+            return {
+                error: 'not a boolean', key, idx,
+            };
+        }
+        // restrict nulls at required switchers
+        if (isrequired && typeof val !== 'boolean') {
+            return {
+                error: 'empty required', key, idx,
+            };
+        }
+    }
+    else if (isrequired && !val) {
         if (options?.conditions) {
             const allowed = JSON.parse(options?.conditions?.[2] || null);
             const check = options?.conditions?.[1] === 'in' && Array.isArray(allowed)
@@ -61,4 +78,4 @@ function checkBody({ body = {}, arr = [], idx }) {
 export default function validateData({ body = {}, schema = {} }) {
     const res = checkBody({ body, arr: Object.keys(schema).map(key => ({ ...schema[key], key })) });
     return res;
-}
+}

package/server/plugins/pg/funcs/getPG.js

@@ -12,7 +12,7 @@ import getDBParams from './getDBParams.js';
 
 function getPG(param) {
   const dbListParams = dblist.find(el => el.key === param?.key)
-    || dblist.find(el => el.database === (param?.db || param?.database || param));
+    || dblist.find(el => el.database === (param?.db || param?.database || param) && el.port === param?.port);
   const {
     user, password, host, port, db, database, name: origin,
   } = dbListParams ?? (typeof param === 'string' ? getDBParams(param) : param || {});

package/server/plugins/pg/funcs/getPGAsync.js

@@ -12,7 +12,7 @@ import getDBParams from './getDBParams.js';
 
 async function getPGAsync(param) {
   const dbListParams = dblist.find(el => el.key === param?.key)
-    || dblist.find(el => el.database === (param?.db || param?.database || param));
+    || dblist.find(el => el.database === (param?.db || param?.database || param) && el.port === param?.port);
   const {
     user, password, host, port, db, database, name: origin,
   } = dbListParams ?? (typeof param === 'string' ? getDBParams(param) : param || {});
@@ -29,8 +29,6 @@ async function getPGAsync(param) {
     statement_timeout: config.pg?.statement_timeout || 10000,
   };
 
-  if (!dbConfig.database) { return null; }
-
   pgClients[name] = new pg.Pool(dbConfig);
 
   await init(pgClients[name]);

package/server/plugins/policy/funcs/checkXSS.js

@@ -3,7 +3,7 @@ import xssInjection from '../xssInjection.js';
 
 function checkXSS({ body, schema = {} }) {
   const data = typeof body === 'string' ? body : JSON.stringify(body);
-  const stopWords = xssInjection.filter((el) => data.toLowerCase().includes(el));
+  const stopWords = xssInjection.filter((el) => data?.toLowerCase?.()?.includes?.(el));
 
   // check sql injection
   const stopSpecialSymbols = data.match(/\p{S}OR\p{S}|\p{P}OR\p{P}| OR |\+OR\+/gi);
@@ -13,7 +13,7 @@ function checkXSS({ body, schema = {} }) {
   const skipScreening = config.skipScreening || ['Summernote', 'Tiny', 'Ace', 'Texteditor'];
   Object.keys(body)
     .filter((key) => ['<', '>'].find((el) => body[key]?.includes?.(el))
-  && !skipScreening.includes(schema?.[key]?.type))
+      && !skipScreening.includes(schema?.[key]?.type))
     ?.forEach((key) => {
       Object.assign(body, { [key]: body[key].replace(/</g, '&lt;').replace(/>/g, '&gt;') });
     });
@@ -24,9 +24,9 @@ function checkXSS({ body, schema = {} }) {
 
   const field = Object.keys(body)
     ?.find((key) => body[key]?.toLowerCase
-        && !disabledCheckFields.includes(key)
-        && (skipScreening.includes(schema?.[key]?.type) ? stopWords.find(el => !['href=', 'src='].includes(el)) : true)
-        && body[key].toLowerCase().includes(stopWords[0]));
+      && !disabledCheckFields.includes(key)
+      && (skipScreening.includes(schema?.[key]?.type) ? stopWords.find(el => !['href=', 'src='].includes(el)) : true)
+      && body[key].toLowerCase().includes(stopWords[0]));
   if (field) {
     console.error(stopWords[0], field, body[field]);
     return { error: `rule: ${stopWords[0]} | attr: ${field} | val: ${body[field]}`, body };

package/server/routes/crud/controllers/deleteCrud.js

@@ -3,7 +3,9 @@ import {
 } from '../../../../utils.js';
 
 export default async function deleteCrud(req, reply) {
-  const { pg = pgClients.client, user, params = {}, headers = {} } = req || {};
+  const {
+    pg = pgClients.client, user, params = {}, headers = {},
+  } = req || {};
 
   const hookData = await applyHook('preDelete', {
     pg, table: params?.table, id: params?.id, user,
@@ -36,7 +38,7 @@ export default async function deleteCrud(req, reply) {
   }).catch(err => {
     if (err.message?.includes?.('foreign key' || 'unique')) {
       const constraint = err.message.match(/constraint "([^"]+)"/g);
-      return reply.status(400).send('Видалення заборонено для збереження цілісності БД: ' + constraint);
+      return reply.status(400).send(`Видалення заборонено для збереження цілісності БД: ${constraint}`);
     }
     if (config.trace) console.error(err.toString());
     return err.toString();

package/server/routes/crud/controllers/insert.js

@@ -2,13 +2,17 @@ import {
   applyHook, getAccess, getTemplate, checkXSS, dataInsert, getToken, config, pgClients, logger, validateData,
 } from '../../../../utils.js';
 
-export default async function insert(req) {
+export default async function insert(req, reply) {
   const {
     pg = pgClients.client, user = {}, params = {}, body = {}, headers = {},
   } = req || {};
-  if (!user) return { message: 'access restricted', status: 403 };
+  if (!user) {
+    return reply.status(403).send('access restricted');
+  }
 
-  const hookData = await applyHook('preInsert', { pg, table: params?.table, user, body });
+  const hookData = await applyHook('preInsert', {
+    pg, table: params?.table, user, body,
+  });
 
   if (hookData?.message && hookData?.status) {
     return { message: hookData?.message, status: hookData?.status };
@@ -23,12 +27,12 @@ export default async function insert(req) {
 
   const { actions = [] } = await getAccess({ table: add, user }, pg) || {};
 
-  if (!actions.includes('add') && !config?.local && !tokenData) {
-    return { message: 'access restricted', status: 403 };
+  if (!actions.includes('add') && !config.local && !config.debug && !tokenData) {
+    return reply.status(403).send('access restricted');
   }
 
   if (!add) {
-    return { message: 'table is required', status: 400 };
+    return reply.status(400).send('table is required');
   }
 
   const loadTemplate = await getTemplate('table', add);
@@ -43,8 +47,10 @@ export default async function insert(req) {
   const xssCheck = checkXSS({ body, schema });
 
   if (xssCheck.error && formData?.xssCheck !== false) {
-    logger.file('injection/xss', { table, form: form || loadTemplate?.form, body, uid: user?.uid, msg: xssCheck.error });
-    return { message: 'Дані містять заборонені символи. Приберіть їх та спробуйте ще раз', status: 409 };
+    logger.file('injection/xss', {
+      table, form: form || loadTemplate?.form, body, uid: user?.uid, msg: xssCheck.error,
+    });
+    return reply.status(409).send('Дані містять заборонені символи. Приберіть їх та спробуйте ще раз');
   }
 
   const fieldCheck = validateData({ body, schema });
@@ -56,7 +62,7 @@ export default async function insert(req) {
       uid: user?.uid,
       ...fieldCheck,
     });
-    return { message: 'Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз', status: 409 };
+    return reply.status(409).send('Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз');
   }
 
   if (![add, table].includes('admin.users')) {
@@ -76,7 +82,10 @@ export default async function insert(req) {
     tokenData,
     referer,
   });
-  if (!res) return { message: 'nothing added ' };
+
+  if (!res) {
+    return reply.status(400).send('nothing added');
+  }
 
   // admin.custom_column
   await applyHook('afterInsert', {

package/server/routes/crud/controllers/table.js

@@ -33,17 +33,20 @@ export default async function tableAPI(req) {
 
   if (tokenData && !id) return { message: {} };
   if (!tableName && !id) {
-    return { message: 'not enough params', status: 400 };
+    return reply.status(400).send('not enough params');
   }
 
   const { actions = [], query: accessQuery } = await getAccess({ table: templateName, id, user }, pg) || {};
 
   if (!actions.includes('edit') && !config?.local && !tokenData) {
-    return { message: 'access restricted', status: 403 };
+    return reply.status(403).send('access restricted');
   }
 
   const { pk, columns: dbColumns = [] } = await getMeta({ pg, table: tableName });
-  if (!pk) return { message: `table not found: ${table}`, status: 404 };
+
+  if (!pk) {
+    return reply.status(404).send(`table not found: ${table}`);
+  }
 
   // const cols = columns.map((el) => el.name || el).join(',');
   const formName = hookData?.form || tokenData?.form || form;
@@ -72,7 +75,10 @@ export default async function tableAPI(req) {
   }
 
   const data = await pg.query(q.replace(/{{uid}}/, user?.uid), [id]).then(el => el.rows[0]);
-  if (!data) return { message: 'not found', status: 404 };
+
+  if (!data) {
+    return reply.status(404).send(`object not found: ${id}`);
+  }
 
   Object.keys(schema).filter(key => schema[key]?.type === 'DataTable').forEach(key => {
     if (data[key] && !Array.isArray(data[key])) { data[key] = null; }

package/server/routes/crud/controllers/update.js

@@ -4,12 +4,15 @@ import {
 import config from '../../../../config.js';
 import insert from './insert.js';
 
-export default async function update(req) {
+export default async function update(req, reply) {
   const {
     pg = pgClients.client, user, params = {}, body = {}, headers = {}, unittest,
   } = req;
 
-  if (!user) return { message: 'access restricted', status: 403 };
+  if (!user) {
+    return reply.status(403).send('access restricted');
+  }
+
   const hookData = await applyHook('preUpdate', {
     pg, table: params?.table, id: params?.id, user,
   });
@@ -27,19 +30,20 @@ export default async function update(req) {
 
   const { actions = [] } = await getAccess({ table: edit, id, user }, pg) || {};
 
-  if (!actions.includes('edit') && !config?.local && !tokenData) {
-    return { message: 'access restricted', status: 403 };
+  if (!actions.includes('edit') && !config.local && !config.debug && !tokenData) {
+    return reply.status(403).send('access restricted');
   }
 
   if (!edit) {
-    return { message: 'table is required', status: 400 };
+    return reply.status(400).send('table is required');
   }
 
   if (!id && tokenData?.table) {
     return insert(req);
   }
+
   if (!id) {
-    return { message: 'id is required', status: 404 };
+    return reply.status(400).send('id is required');
   }
 
   const loadTemplate = await getTemplate('table', edit);
@@ -59,7 +63,7 @@ export default async function update(req) {
 
   if (xssCheck.error && formData?.xssCheck !== false) {
     logger.file('injection/xss', { msg: xssCheck.error, table }, req);
-    return { message: 'Дані містять заборонені символи. Приберіть їх та спробуйте ще раз', status: 409 };
+    return reply.status(409).send('Дані містять заборонені символи. Приберіть їх та спробуйте ще раз');
   }
 
   const fieldCheck = validateData({ body, schema });
@@ -71,7 +75,7 @@ export default async function update(req) {
       uid: user?.uid,
       ...fieldCheck,
     });
-    return { message: 'Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз', status: 409 };
+    return reply.status(409).send('Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз');
   }
 
   const res = await dataUpdate({
@@ -100,7 +104,9 @@ export default async function update(req) {
       // insert new extra data
       if (Array.isArray(body[key]) && body[key]?.length) {
         const extraRows = await Promise.all(body[key]?.map?.(async (row) => {
-          const extraRes = await dataInsert({ pg, table: schema[key].table, data: { ...row, [schema[key].parent_id]: objId }, uid, tokenData, referer });
+          const extraRes = await dataInsert({
+            pg, table: schema[key].table, data: { ...row, [schema[key].parent_id]: objId }, uid, tokenData, referer,
+          });
           return extraRes?.rows?.[0];
         }));
         Object.assign(res.extra, { [key]: extraRows.filter((el) => el) });

package/server/routes/table/controllers/suggest.js

@@ -1,9 +1,8 @@
 import path from 'node:path';
-import { fileURLToPath } from 'url';
 import { existsSync, readFileSync } from 'node:fs';
 
 import {
-  config, getPG, getTemplate, getSelectMeta, getMeta, applyHook, getSelectVal,
+  config, getPG, getTemplate, getSelectMeta, getMeta, applyHook, getSelectVal, logger,
 } from '../../../../utils.js';
 
 const limit = 50;
@@ -13,8 +12,6 @@ const headers = {
   'Cache-Control': 'no-cache',
 };
 
-const dirname = path.dirname(fileURLToPath(import.meta.url));
-
 function getTableColumnMeta(table, column, filtered) {
   const original = {
     true: `with c(id,text) as (select ${column}, ${column} from ${table} group by ${column}) select id, text from c`,
@@ -70,7 +67,9 @@ export default async function suggest(req) {
 
   const meta = table && column
     ? getTableColumnMeta(table, column, query?.key || query?.val)
-    : await getSelectMeta({ pg: pg1, name: selectName, nocache: query?.nocache, parent });
+    : await getSelectMeta({
+      pg: pg1, name: selectName, nocache: query?.nocache, parent,
+    });
 
   if (meta?.minLength && query.key && query.key.length < meta?.minLength) {
     return { message: `min length: ${meta.minLength}` };
@@ -93,10 +92,10 @@ export default async function suggest(req) {
 
     const { columns = [] } = await getMeta({ pg, table: loadTable?.table || tableName });
 
-    const column = columns.find(el => el.name === query.column);
+    const column1 = columns.find(el => el.name === query.column);
     const args = { table: tableName };
-    if (!column) return [];
-    const sqlCls = `select array_agg(distinct value)::text[] from (select ${pg.pgType?.[column.dataTypeID]?.includes('[]') ? `unnest(${column.name})` : `${column.name}`} as value from ${(loadTable?.table || tableName).replace(/'/g, "''")} where ${hookBody?.query || loadTable?.query || '1=1'})q`;
+    if (!column1) return [];
+    const sqlCls = `select array_agg(distinct value)::text[] from (select ${pg.pgType?.[column1.dataTypeID]?.includes('[]') ? `unnest(${column1.name})` : `${column1.name}`} as value from ${(loadTable?.table || tableName).replace(/'/g, "''")} where ${hookBody?.query || loadTable?.query || '1=1'})q`;
 
     if (query.sql && (config.local || user?.user_type?.includes?.('admin'))) {
       return sqlCls;
@@ -113,6 +112,20 @@ export default async function suggest(req) {
 
       const data2 = data1.filter((el) => el.id && vals.includes(el.id.toString()));
       const data = data2.slice(0, Math.min(query.limit || limit, limit));
+
+      if (config.debug) {
+        logger.file('suggest/debug', {
+          type: 1,
+          loadTable: loadTable?.table,
+          tableName,
+          column: column?.name,
+          data,
+          data1,
+          data2,
+          query,
+        });
+      }
+
       return {
         time: Date.now() - time,
         limit: Math.min(query.limit || limit, limit),
@@ -122,7 +135,7 @@ export default async function suggest(req) {
         sql: (config.local || user?.user_type?.includes?.('admin')) ? sqlCls : undefined,
         data,
       };
-    };
+    }
   }
 
   if (arr) {
@@ -131,6 +144,16 @@ export default async function suggest(req) {
       ? arr?.filter((el) => !lower || (el[lang] || el.text)?.toLowerCase()?.indexOf(lower) !== -1)?.filter((el) => !query.val || el.id === query.val)
       : arr;
     const data = data1.slice(0, Math.min(query.limit || limit, limit));
+
+    if (config.debug) {
+      logger.file('suggest/debug', {
+        type: 2,
+        key: query.key,
+        data,
+        data1,
+      });
+    }
+
     return {
       time: Date.now() - time,
       limit: Math.min(query.limit || limit, limit),
@@ -183,6 +206,17 @@ export default async function suggest(req) {
     data.forEach(el => Object.assign(el, { text: clsData?.[el.id || ''] || el.id }));
   }
 
+  if (config.debug) {
+    logger.file('suggest/debug', {
+      type: 3,
+      sel: query.sel,
+      data,
+      dataNew,
+      sqlSuggest,
+      ids,
+    });
+  }
+
   const message = {
     time: Date.now() - time,
     limit: Math.min(query.limit || meta.limit || limit, limit),