@opengis/fastify-table 1.4.10 → 1.4.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "1.4.10",
+  "version": "1.4.11",
   "type": "module",
   "description": "core-plugins",
   "keywords": [

package/server/plugins/crud/funcs/getAccess.js

@@ -2,16 +2,7 @@ import pgClients from '../../pg/pgClients.js';
 import getTemplate from '../../table/funcs/getTemplate.js';
 import applyHook from '../../hook/funcs/applyHook.js';
 
-/**
- * @param {Array} user_roles.actions Actions - user actions <> group actions
- * @param {Array} role_access.actions Actions - user actions = group actions
- * @param {String} body.actions Actions from table template
- * @param {String} table Table name / Interface alias
- * @param {Object} user User object
- * @param {String} user.uid User ID
- * @param {String} user.user_type User type
- * @returns { scope: String, actions: String[], query: String }
- */
+const allActions = ['view', 'edit', 'add', 'del'];
 
 const q = `select a.route_id as id, d.actions as user_roles, d.actions as role_actions, coalesce(b.actions, array['view']) as interface_actions, b.scope, c.role_id
 from admin.routes a 
@@ -29,7 +20,18 @@ left join admin.user_roles d on
         end )
 where $1 in (a.route_id, a.alias, a.table_name) and $2 in (b.user_uid, d.user_uid)`;
 
-export default async function getAccess({ table, user = {} }, pg = pgClients.client) {
+/**
+ * @param {Array} user_roles.actions Actions - user actions <> group actions
+ * @param {Array} role_access.actions Actions - user actions = group actions
+ * @param {String} body.actions Actions from table template
+ * @param {String} table Table name / Interface alias
+ * @param {Object} user User object
+ * @param {String} user.uid User ID
+ * @param {String} user.user_type User type
+ * @returns { scope: String, roles: String[], actions: String[], query: String }
+ */
+
+export default async function getAccess({ table, form, user = {} }, pg = pgClients.client) {
   if (!table) return null;
 
   const hookData = await applyHook('getAccess', { table, user, pg });
@@ -38,15 +40,19 @@ export default async function getAccess({ table, user = {} }, pg = pgClients.cli
   const { uid, user_type: userType = 'regular' } = user;
 
   if (userType === 'superadmin') {
-    return { actions: ['view', 'edit', 'add', 'del'], query: '1=1' };
+    return { actions: allActions, query: '1=1' };
   }
 
   const body = await getTemplate('table', table);
-  const tableActions = ['view'].concat(body?.actions || body?.action_default || []);
+  const tableActions = !body && form
+    ? allActions // if db table and form => full access (token)
+    : ['view'].concat(body?.actions || body?.action_default || []);
 
   if (userType === 'admin') {
-    const adminActions = body?.form ? ['view', 'del', 'edit', 'add'] : ['view', 'del'];
-    return { actions: body?.actions || body?.action_default ? tableActions : adminActions, query: '1=1' };
+    if (!(body?.actions || body?.action_default) && (body?.form || form)) {
+      return { actions: allActions, query: '1=1' };
+    }
+    return { actions: tableActions, query: '1=1' };
   }
 
   if (body?.public || body?.access === 'public') {
@@ -76,7 +82,7 @@ export default async function getAccess({ table, user = {} }, pg = pgClients.cli
   const query = userAccess?.scope === 'my' ? `uid='${uid}'` : '1=1';
   const actions = userAccess?.interface_actions
     ?.filter?.((el, idx, arr) => arr.indexOf(el) === idx)
-    ?.filter(el => userAccess?.role_actions?.length ? userAccess?.role_actions.includes(el) : true)
+    ?.filter(el => (userAccess?.role_actions?.length ? userAccess?.role_actions.includes(el) : true))
     ?.filter(el => tableActions.includes(el));
   return {
     scope: userAccess?.scope,

package/server/routes/crud/controllers/deleteCrud.js

@@ -28,7 +28,7 @@ export default async function deleteCrud(req, reply) {
   }
 
   if (!actions.includes('del') && !config?.local) {
-    return reply.status(403).send('access restricted');
+    return reply.status(403).send('access restricted: actions');
   }
 
   const loadTemplate = await getTemplate('table', del);

package/server/routes/crud/controllers/insert.js

@@ -26,14 +26,14 @@ export default async function insert(req, reply) {
 
   const { form, table: add } = hookData || tokenData || (config.security?.disableToken || config.local || config.auth?.disable ? req.params : {});
 
-  const { actions = [] } = await getAccess({ table: add, user }, pg) || {};
+  const { actions = [] } = await getAccess({ table: add, form, user }, pg) || {};
 
   if (!tokenData && !config.local && !config.security?.disableToken && !config.auth?.disable) {
     return reply.status(400).send('invalid token');
   }
 
   if (!actions.includes('add') && !config.local) {
-    return reply.status(403).send('access restricted');
+    return reply.status(403).send('access restricted: actions');
   }
 
   if (!add) {

package/server/routes/crud/controllers/table.js

@@ -17,57 +17,56 @@ export default async function tableAPI(req, reply) {
   if (hookData?.message && hookData?.status) {
     return { message: hookData?.message, status: hookData?.status };
   }
-  const tableName1 = hookData?.table || tokenData.table || params.table;
+  const templateName = hookData?.table || tokenData.table || params.table;
+
+  const loadTable = await getTemplate('table', templateName);
 
-  const loadTable = await getTemplate('table', tableName1) || {};
   if (!loadTable && !pg.pk?.[tokenData.table]) {
     return { message: 'not found', status: 404 };
   }
 
-  const { table, /* columns, */ form } = loadTable;
-
-  const templateName = hookData?.table || tokenData.table || params.table;
-  const tableName = table || templateName;
+  const { table = params.table, /* columns, */ form } = hookData || loadTable || tokenData;
 
   const id = hookData?.id || tokenData.id || params.id;
 
   if (tokenData && !id) return { message: {} };
-  if (!tableName && !id) {
+  if (!table && !id) {
     return reply.status(400).send('not enough params');
   }
 
-  const { actions = [], query: accessQuery } = await getAccess({ table: templateName, id, user }, pg) || {};
+  const { actions = [], query: accessQuery } = await getAccess({
+    table, form, id, user,
+  }, pg) || {};
 
   if (!tokenData && !config?.local && !config.security?.disableToken) {
     return reply.status(400).send('invalid token');
   }
 
   if (!actions.includes('edit') && !config?.local) {
-    return reply.status(403).send('access restricted');
+    return reply.status(403).send('access restricted: actions');
   }
 
-  const { pk, columns: dbColumns = [] } = await getMeta({ pg, table: tableName });
+  const { pk, columns: dbColumns = [] } = await getMeta({ pg, table });
 
   if (!pk) {
     return reply.status(404).send(`table not found: ${table}`);
   }
 
   // const cols = columns.map((el) => el.name || el).join(',');
-  const formName = hookData?.form || tokenData?.form || form;
-  const formData = await getTemplate('form', formName) || {};
+  const formData = await getTemplate('form', form) || {};
   const schema = formData?.schema || formData || {};
   // skip DataTable from another table
   const extraKeys = Object.keys(schema).filter((key) => schema[key]?.table && schema[key]?.parent_id && Object.hasOwn(schema[key], 'colModel'));
   // skip non-existing columns
   const columnList = dbColumns.map((el) => el.name || el).join(',');
 
-  const { fields = [] } = !loadTable?.table ? await pg.query(`select * from ${tableName} limit 0`) : {};
+  const { fields = [] } = !loadTable?.table ? await pg.query(`select * from ${table} limit 0`) : {};
   const cols = loadTable?.table
     ? Object.keys(schema || {}).filter((col) => columnList.includes(col) && !extraKeys.includes(col))?.map((col) => (col?.includes('geom') && schema?.[col]?.type === 'Geom' ? `st_asgeojson(${col})::json as "${col}"` : `"${col}"`))?.join(',')
     : fields.map((el) => (el?.name?.includes('geom') && pg.pgType[el?.dataTypeID] === 'geometry' ? `st_asgeojson(${el.name})::json as "${el.name}"` : `"${el?.name}"`)).join(',');
-  const where = [`"${pk}" = $1`, loadTable.query, accessQuery].filter((el) => el).filter((el) => (user?.user_type === 'superadmin' ? !el.includes('{{uid}}') : true));
+  const where = [`"${pk}" = $1`, loadTable?.query, accessQuery].filter(Boolean).filter((el) => (user?.user_type === 'superadmin' ? !el.includes('{{uid}}') : true));
   const geom = dbColumns.find((el) => el.name === 'geom' && pg.pgType[el.dataTypeID] === 'geometry') ? ',st_asgeojson(geom)::json as geom' : '';
-  const q = `select "${pk}" as id, ${cols || '*'} ${geom} from ${tableName} t where ${where.join(' and ') || 'true'} limit 1`;
+  const q = `select "${pk}" as id, ${cols || '*'} ${geom} from ${table} t where ${where.join(' and ') || 'true'} limit 1`;
 
   if (query?.sql === '1') {
     const extraQ = extraKeys?.map((key) => {
@@ -93,23 +92,23 @@ export default async function tableAPI(req, reply) {
       const { colModel, table: extraTable, parent_id: parentId } = schema[key];
       const colModel1 = Array.isArray(colModel) ? colModel : Object.values(colModel || {});
       const q1 = `select ${parentId} as parent, ${colModel1.map((col) => col.name || col.key).join(',')} from ${extraTable} a where ${parentId}=$1`;
-      // console.log(tableName, formName, q1);
+      // console.log(table, formName, q1);
       const { rows: extraRows } = await pg.query(q1, [id]);
       Object.assign(data, { [key]: extraRows });
     }));
   }
   if (user?.uid && !config.security?.disableToken && actions.includes('edit')) {
     data.token = tokenData?.table ? params.table : setToken({
-      ids: [JSON.stringify({ id, table: tableName, form: loadTable.form })],
+      ids: [JSON.stringify({ id, table, form })],
       uid: user.uid,
       array: 1,
     })?.[0];
   }
 
-  await extraDataGet({ rows: [data], table: tableName, form: hookData?.form || tokenData?.form || loadTable.form }, pg);
+  await extraDataGet({ rows: [data], table, form }, pg);
 
   const res = await applyHook('afterTable', {
-    pg, table: tableName, payload: [data], user,
+    pg, table, payload: [data], user,
   });
 
   return res || data || {};

package/server/routes/crud/controllers/update.js

@@ -28,14 +28,16 @@ export default async function update(req, reply) {
 
   const { form, table: edit, id } = hookData || tokenData || (config.security?.disableToken || config.local || config.auth?.disable ? params : {});
 
-  const { actions = [] } = await getAccess({ table: edit, id, user }, pg) || {};
+  const { actions = [] } = await getAccess({
+    table: edit, form, id, user,
+  }, pg) || {};
 
   if (!tokenData && !config.local && !config.security?.disableToken && !config.auth?.disable) {
     return reply.status(400).send('invalid token');
   }
 
   if (!actions.includes('edit') && !config.local) {
-    return reply.status(403).send('access restricted');
+    return reply.status(403).send('access restricted: actions');
   }
 
   if (!edit) {