@opengis/fastify-table 1.4.82 → 1.4.83

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "1.4.82",
+  "version": "1.4.83",
   "type": "module",
   "description": "core-plugins",
   "keywords": [

package/server/plugins/crud/funcs/dataDelete.js

@@ -11,7 +11,7 @@ import logger from '../../logger/getLogger.js';
 const rclient = getRedis();
 
 export default async function dataDelete({
-  table: table1, tokenData, referer, id, pg: pg1, uid,
+  table: table1, tokenData, referer, id, pg: pg1, uid, query = 'true',
 }) {
   const pg = pg1 || getPG({ name: 'client' });
 
@@ -30,7 +30,7 @@ export default async function dataDelete({
 
   const { pk } = await getMeta({ pg, table });
 
-  const delQuery = `delete from ${table} WHERE ${pk}::text = $1::text returning *`;
+  const delQuery = `delete from ${table} WHERE ${pk}::text = $1::text and ${query} returning *`;
 
   // for transactions
   const isClient = typeof pg.query === 'function' && typeof pg.release === 'function';

package/server/plugins/pg/funcs/init.js

@@ -44,8 +44,8 @@ async function init(client) {
   }
 
   async function querySafe(q, param = {}) {
-    const { args, isstream } = param;
-    const data = await query(q, args, isstream);
+    const args = Array.isArray(param) ? param : (param.args || []);
+    const data = await query(q, args, true);
     return data;
   }
 

package/server/plugins/util/funcs/unflattenObject.js

@@ -10,6 +10,7 @@ export default function unflattenObject(flatObj) {
             if (index === keys.length - 1) {
                 // json array
                 if (typeof flatObj[key] === 'string' && flatObj[key].startsWith('[') && flatObj[key] !== ('[object Object]')) {
+                    // console.log('unflatten aray', key);
                     try {
                         nestedObj[part] = JSON.parse(flatObj[key] || '{}');
                     }
@@ -18,7 +19,8 @@ export default function unflattenObject(flatObj) {
                         nestedObj[part] = flatObj[key]; // fallback to original value if parsing fails
                     }
                 }
-                else if (['true', 'false'].includes(flatObj[key]) || (!isNaN(flatObj[key]) && key !== 'auth.uid')) {
+                else if (['true', 'false'].includes(flatObj[key]) || (!isNaN(flatObj[key])) && false) {
+                    // console.log('unflatten number', key);
                     try {
                         nestedObj[part] = JSON.parse(flatObj[key] || '{}');
                     }
@@ -28,6 +30,7 @@ export default function unflattenObject(flatObj) {
                     }
                 }
                 else {
+                    // console.log('unflatten else', key);
                     nestedObj[part] = flatObj[key];
                 }
             }

package/server/routes/crud/controllers/deleteCrud.js

@@ -18,17 +18,31 @@ export default async function deleteCrud(req, reply) {
   const { referer } = headers;
   const tokenData = await getToken({
     uid: user.uid, token: params.id || params.table, json: 1,
-  }) || await getOpt(params.id || params.table, user.uid);
+  }) || await getOpt(params.id || params.table, user.uid) || await getOpt(params.table, user.uid);
 
-  const { table: del, id } = hookData || tokenData || (config.security?.disableToken || config.local || config.auth?.disable ? req.params : {});
+  const {
+    table: del, id = params.id, query, actions: actionsToken,
+  } = hookData || tokenData || (config.security?.disableToken || config.local || config.auth?.disable ? req.params : {});
+  if (actionsToken && !actionsToken?.include('del')) {
+    return reply.status(403).send({
+      error: 'del is not allowed ',
+      code: 403,
+    });
+  }
   const { actions = [] } = await getAccess({ table: del, id, user }, pg) || {};
 
   if (!tokenData && !config?.local && !config.security?.disableToken && !config.auth?.disable) {
-    return reply.status(400).send('invalid token');
+    return reply.status(403).send({
+      error: 'invalid token',
+      code: 403,
+    });
   }
 
   if (!actions.includes('del') && !config?.local && !tokenData) {
-    return reply.status(403).send('access restricted: actions');
+    return reply.status(403).send({
+      error: 'access restricted: actions',
+      code: 403,
+    });
   }
 
   const loadTemplate = await getTemplate('table', del);
@@ -36,22 +50,34 @@ export default async function deleteCrud(req, reply) {
   const { table } = loadTemplate || hookData || tokenData || req.params || {};
 
   if (!table) {
-    return reply.status(404).send('table is required');
+    return reply.status(404).send({
+      error: 'table is required',
+      code: 404,
+    });
   }
 
   if (!id) {
-    return reply.status(404).send('id is required');
+    return reply.status(404).send({
+      error: 'id is required',
+      code: 404,
+    });
   }
 
   const data = await dataDelete({
-    pg, table, id, uid: user?.uid, tokenData, referer,
+    pg, table, id, uid: user?.uid, tokenData, referer, query,
   }).catch(err => {
     if (err.message?.includes?.('foreign key' || 'unique')) {
       const constraint = err.message.match(/constraint "([^"]+)"/g);
-      return reply.status(400).send(`Видалення заборонено для збереження цілісності БД: ${constraint}`);
+      return reply.status(400).send({
+        error: `Видалення заборонено для збереження цілісності БД: ${constraint}`,
+        code: 400,
+      });
     }
     if (config.trace) console.error(err.toString());
-    return err.toString();
+    return {
+      error: err.toString(),
+      code: 400,
+    };
   });
 
   return reply.status(200).send({ rowCount: data?.rowCount || 0, msg: !data?.rowCount ? data : null });

package/server/routes/table/controllers/tableData.js

@@ -30,7 +30,7 @@ export default async function getTableData(req, reply, called) {
         }
 
         const resp = await getData({
-            pg, params: { id, table: tokenData.table }, headers, query, user, contextQuery: [contextQuery1, tokenData.query].filter(Boolean).join(' and '), sufix, filterList,
+            pg, params: { id, table: tokenData.table }, headers, query, user, contextQuery: [contextQuery1, tokenData.query].filter(Boolean).join(' and '), sufix, filterList, actions: tokenData1?.actions,
         }, reply, called);
         if (resp?.addToken && tokenData.obj) { Object.assign(resp, { addToken: params.table }); }
         return resp;
@@ -52,7 +52,7 @@ export default async function getTableData(req, reply, called) {
     const contextQuery = [contextQuery1, interfaceQuery, context].filter(Boolean).join(' and ') || ' 2=2 ';
 
     const res = await getData({
-        pg, params, query, headers, user, contextQuery, sufix, filterList,
+        pg, params, query, headers, user, contextQuery, sufix, filterList, actions: tokenData1?.actions,
     }, reply, called);
     const route = pg.tlist?.includes('admin.routes') ? await pg.query('select route_id as path, title from admin.routes where enabled and alias=$1 limit 1', [params.table])
         .then(el => el.rows?.[0] || {}) : {};

package/server/routes/table/functions/getData.js

@@ -34,7 +34,7 @@ const defaultLimit = 20;
 
 export default async function dataAPI(req, reply, called) {
   const {
-    pg = pgClients.client, params, headers = {}, query = {}, user = {}, contextQuery, sufix = true, filterList,
+    pg = pgClients.client, params, headers = {}, query = {}, user = {}, contextQuery, sufix = true, filterList, actions: actionsParam,
   } = req;
 
   const time = Date.now();
@@ -52,8 +52,8 @@ export default async function dataAPI(req, reply, called) {
   }
 
   const tokenData = await getOpt(params.table, user?.uid);
-
-  const loadTable = await getTemplate('table', tokenData?.table || hookData?.table || params.table);
+  const templateName = tokenData?.table || hookData?.table || params.table;
+  const loadTable = await getTemplate('table', templateName);
 
   // check sql inline fields count
   if (!checkInline[params?.table] && loadTable?.sql?.length && loadTable.table) {
@@ -227,7 +227,7 @@ export default async function dataAPI(req, reply, called) {
 
   timeArr.push(Date.now());
 
-  if (uid && rows.length && !config.security?.disableToken && (editable || actions.includes('edit') || actions.includes('del'))) {
+  if (uid && rows.length && !config.security?.disableToken && (editable || actionsParam?.includes('edit') || actions.includes('edit') || actions.includes('del'))) {
     rows.forEach(row => {
       Object.assign(row, {
         token: setToken({
@@ -381,8 +381,8 @@ export default async function dataAPI(req, reply, called) {
 
     public: ispublic,
     tokens,
-    card: loadTable?.card,
-    actions,
+    card: !!(loadTable?.card ?? await getTemplate('card', templateName)),
+    actions: actionsParam || actions || ['view'],
     total,
     filtered,
     count: rows.length,