@opengis/fastify-table 1.4.7 → 1.4.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "1.4.7",
+  "version": "1.4.8",
   "type": "module",
   "description": "core-plugins",
   "keywords": [

package/server/plugins/table/funcs/getData.js

@@ -1,8 +1,14 @@
 import routeData from '../../../routes/table/controllers/tableData.js';
 
-export default async function getData({ id, table, pg, filter, state, limit, page, search, user, order, sql, contextQuery, sufix }, reply, called) {
+export default async function getData({
+  id, table, pg, headers, filter, state, limit, page, search, user, order, sql, contextQuery, sufix,
+}, reply, called) {
   const params = { table, id };
-  const query = { filter, limit, page, search, sql, state, order };
-  const result = await routeData({ pg, params, query, user, contextQuery, sufix }, reply, called);
+  const query = {
+    filter, limit, page, search, sql, state, order,
+  };
+  const result = await routeData({
+    pg, headers, params, query, user, contextQuery, sufix,
+  }, reply, called);
   return result;
 }

package/server/routes/table/controllers/cardData.js

@@ -14,7 +14,7 @@ const components = {
 
 export default async function getCardData(req, reply) {
     const {
-        pg, params = {}, user = {},
+        pg, headers, params = {}, user = {},
     } = req;
 
     const { table, id } = params;
@@ -36,15 +36,21 @@ export default async function getCardData(req, reply) {
 
     const index = template?.find(el => el[0] === 'index.yml')?.[1] || {};
 
-    const { message, rows = [] } = index.table && index.query
+    const result = index.table && index.query
         ? await pg.query(
             `select * from ${index.table} where ${handlebarsSync.compile(index.query)({ uid, user })}`,
         )
         : await getData({
-            pg, table, id, user,
+            pg, table, id, user, headers,
         }, reply);
 
-    if (message) return message;
+    if (result?.message) return result?.message;
+
+    if (!result?.rows?.length) {
+        return reply.status(403).send('access restricted: empty rows');
+    }
+
+    const { rows = [] } = result;
 
     // conditions
     index.panels?.filter(el => el.items).forEach(el1 => {

package/server/routes/table/controllers/tableData.js

@@ -6,7 +6,7 @@ import getData from '../functions/getData.js';
 
 export default async function getTableData(req, reply, called) {
     const {
-        user = {}, params = {}, query = {}, pg = pgClients.client, contextQuery: contextQuery1, sufix = true,
+        user = {}, params = {}, headers = {}, query = {}, pg = pgClients.client, contextQuery: contextQuery1, sufix = true,
     } = req;
 
     const { id } = params || {};
@@ -28,7 +28,7 @@ export default async function getTableData(req, reply, called) {
         }
 
         const resp = await getData({
-            pg, params: { id, table: tokenData.table }, query, user, contextQuery: [contextQuery1, tokenData.query].filter(Boolean).join(' and '), sufix,
+            pg, params: { id, table: tokenData.table }, headers, query, user, contextQuery: [contextQuery1, tokenData.query].filter(Boolean).join(' and '), sufix,
         }, reply, called);
         if (resp?.addToken && tokenData.obj) { Object.assign(resp, { addToken: params.table }); }
         return resp;
@@ -50,7 +50,7 @@ export default async function getTableData(req, reply, called) {
     const contextQuery = [contextQuery1, interfaceQuery, context].filter(Boolean).join(' and ') || ' 2=2 ';
 
     const res = await getData({
-        pg, params, query, user, contextQuery, sufix,
+        pg, params, query, headers, user, contextQuery, sufix,
     }, reply, called);
 
     return res;

package/server/routes/table/functions/getData.js

@@ -19,7 +19,7 @@ const defaultLimit = 20;
 
 export default async function dataAPI(req, reply, called) {
   const {
-    pg = pgClients.client, params, query = {}, user = {}, contextQuery, sufix = true,
+    pg = pgClients.client, params, headers = {}, query = {}, user = {}, contextQuery, sufix = true,
   } = req;
 
   const time = Date.now();
@@ -186,6 +186,10 @@ export default async function dataAPI(req, reply, called) {
     throw new Error(err.toString());
   });
 
+  if (!rows.length && headers?.referer?.includes?.('/card/')) {
+    return reply.status(403).send('access restricted: empty rows');
+  }
+
   timeArr.push(Date.now());
 
   if (uid && rows.length && !config.security?.disableToken && (editable || actions.includes('edit') || actions.includes('del'))) {