@opengis/fastify-table 1.4.87 → 1.5.0

package/server/plugins/pg/funcs/init.js

@@ -1,117 +0,0 @@
-/* eslint-disable no-console */
-import { createHash } from 'node:crypto';
-
-import config from '../../../../config.js';
-import getRedis from '../../redis/funcs/getRedis.js';
-import logger from '../../logger/getLogger.js';
-
-const rclient = getRedis({ db: 0 });
-
-async function init(client) {
-  if (!client?.options?.database) {
-    return;
-  }
-  const textQuery = `select 
-  (select json_object_agg(conrelid::regclass  ,(SELECT attname FROM pg_attribute WHERE attrelid = c.conrelid and attnum = c.conkey[1]))
-  from   pg_constraint c where contype='p' and connamespace::regnamespace::text not in ('sde')) as pk,
-  (SELECT json_object_agg(t.oid::text,pg_catalog.format_type(t.oid, NULL)) FROM pg_catalog.pg_type t) as "pgType"`;
-  const { pgType, pk } = await client.query(textQuery).then((d) => d.rows[0]);
-
-  const tlist = await client.query(`select array_agg((select nspname from pg_namespace where oid=relnamespace)||'.'||relname) tlist 
-    from pg_class where relkind in ('r','v')`).then((d) => d.rows[0].tlist);
-
-  const { rows = [] } = await client.query(`select (select nspname from pg_namespace where oid=relnamespace)||'.'||relname as tname, relkind
-      from pg_class where relkind in ('r','v')`);
-  const relkinds = rows.reduce((acc, curr) => Object.assign(acc, { [curr.tname]: curr.relkind }), {});
-
-  async function query(q, args = [], isstream = false) {
-    try {
-      if (isstream) {
-        await client.query('set statement_timeout to 100000000');
-      }
-      const data = await client.query(q, args);
-      await client.query('set statement_timeout to 0');
-      return data;
-    }
-    catch (err) {
-      await client.query('set statement_timeout to 0');
-      if (err.message === 'canceling statement due to statement timeout') {
-        logger.file('timeout/query', { q, stack: err.stack });
-        return { rows: [], timeout: true };
-      }
-      throw new Error(err);
-    }
-  }
-
-  async function querySafe(q, param = {}) {
-    const args = Array.isArray(param) ? param : (param.args || []);
-    const data = await query(q, args, true);
-    return data;
-  }
-
-  async function one(q, param = {}) {
-    const data = await query(q, Array.isArray(param) ? param : param.args || []);
-    const result = ((Array.isArray(data) ? data.pop() : data)?.rows || [])[0] || {};
-    return result;
-  }
-
-  async function queryNotice(q, args = [], cb = () => { }) {
-    const clientCb = await client.connect();
-    clientCb.on('notice', (e) => {
-      cb(e.message);
-    });
-    let result;
-    try {
-      result = await clientCb.query(q, args);
-      clientCb.end();
-    }
-    catch (err) {
-      clientCb.end();
-      cb(err.toString(), 1);
-      throw err;
-    }
-    return result;
-  }
-
-  async function queryCache(q, param = {}) {
-    const { table, args = [], time = 15 } = param;
-    const seconds = typeof time !== 'number' || time < 0 ? 0 : time * 60;
-
-    if (seconds === 0 || config.disableCache) {
-      const data = await query(q, args || []);
-      return data;
-    }
-
-    // CRUD table state
-    const keyCacheTable = `pg:${table}:crud`;
-    const crudInc = table && config.redis ? (await rclient.get(keyCacheTable) || 0) : 0;
-
-    //
-    const hash = createHash('sha1').update([q, JSON.stringify(args)].join()).digest('base64');
-    const keyCache = `pg:${hash}:${crudInc}`;
-
-    const cacheData = config.redis ? await rclient.get(keyCache) : null;
-
-    if (cacheData && !config.local) {
-      // console.log('from cache', table, query);
-      return JSON.parse(cacheData);
-    }
-
-    const data = await query(q, args || []);
-
-    if (seconds > 0 && config.redis) {
-      rclient.set(keyCache, JSON.stringify(data), 'EX', seconds);
-    }
-
-    // console.log('no cache', table, crudInc, query);
-    return data;
-  }
-
-  Object.assign(client, {
-    one, pgType, pk, tlist, relkinds, queryCache, queryNotice, querySafe,
-  });
-  console.log('db connected', client.options?.database);
-}
-
-// export default client;
-export default init;

package/server/plugins/pg/index.js

@@ -1,54 +0,0 @@
-import pgClients from './pgClients.js';
-import getPGAsync from './funcs/getPGAsync.js';
-
-import logger from '../logger/getLogger.js';
-
-function close() {
-  Object.keys(pgClients).forEach((el) => {
-    pgClients[el].end();
-  });
-}
-
-async function getHeadersPG(req, config) {
-  if (!req.headers?.token) return null;
-  const validToken = (req.ip === '193.239.152.181'
-    || req.ip === '127.0.0.1'
-    || req.ip.startsWith('192.168.')
-    || config.debug
-  )
-    && req.headers?.token
-    && config.auth?.tokens?.includes?.(req.headers.token);
-
-  if (validToken && req.headers?.db) {
-    const pg = pgClients[req.headers.db]
-      || await getPGAsync(req.headers.db);
-    return pg;
-  }
-  return null;
-}
-
-async function plugin(fastify, config) {
-  const client = await getPGAsync({ ...config.pg || {}, name: 'client' });
-
-  fastify.addHook('onRequest', async (req) => {
-    const headersPG = await getHeadersPG(req, config);
-    req.pg = headersPG || req.pg || client || pgClients.client;
-    if (headersPG) {
-      req.user = { uid: req.headers?.uid };
-      req.folder = config.folder;
-      req.root = config.root;
-    }
-  });
-
-  fastify.addHook('onError', async (req, reply, err) => {
-    if (err.message === 'canceling statement due to statement timeout') {
-      logger.file('timeout/request', {
-        method: req.method, url: req.url, referer: req.headers?.referer, stack: err.stack,
-      });
-    }
-  });
-
-  fastify.addHook('onClose', close);
-}
-
-export default plugin;

package/server/plugins/pg/pgClients.js

@@ -1,22 +0,0 @@
-import pg from 'pg';
-
-import config from '../../../config.js';
-import init from './funcs/init.js';
-
-const pgClients = {};
-if (config.pg) {
-  const client = new pg.Pool({
-    host: config.pg?.host || '127.0.0.1',
-    port: config.pg?.port || 5432,
-    database: config.pg?.database || 'postgres',
-    user: config.pg?.user || 'postgres',
-    password: config.pg?.password || 'postgres',
-    statement_timeout: config.pg?.statement_timeout || 10000,
-  });
-  client.init = async () => {
-    await init(client);
-  };
-  client.init();
-  pgClients.client = client;
-}
-export default pgClients;

package/server/plugins/policy/funcs/checkPolicy.js

@@ -1,127 +0,0 @@
-import { config, logger } from '../../../../utils.js';
-import block from '../sqlInjection.js';
-
-const { skipCheckPolicyRoutes = [] } = config;
-
-const skipCheckPolicy = (path) => skipCheckPolicyRoutes.find(el => path.includes(el));
-/**
- * Middleware func
- *
- * @type function
- * @alias checkPolicy
- * @summary Функція дозволяє налаштувати доступ до сайту або API для адмін. та публічної частини веб-ресурсу
- * @param {String} path - назва апі
- * @returns {object|null} Returns object
- */
-
-export default function checkPolicy(req, reply) {
-  const {
-    originalUrl: path, hostname, query, params, headers, method, session, routeOptions, unittest,
-  } = req;
-
-  if (config.local || unittest || config.env === 'test') { return null; }
-
-  const body = JSON.stringify(req?.body || {}).substring(30);
-
-  const isAdmin = process.env.NODE_ENV === 'admin' || hostname.split(':').shift() === config.adminDomain || config.admin || hostname.startsWith('admin');
-  const user = req.user || session?.passport?.user;
-
-  const isUser = config?.debug || !!user;
-
-  const isServer = process.argv[2];
-  const { policy = [] } = routeOptions?.config || {};
-
-  /*= == 0.Check superadmin access  === */
-  if (policy.includes('admin') && user?.user_type !== 'admin' && !config.auth?.disable) {
-    logger.file('policy/access', {
-      path, method, params, query, body, message: 'access restricted: not admin', uid: user?.uid,
-    });
-    return reply.status(403).send('access restricted: 0');
-  }
-
-  /*= == 1.File injection  === */
-  if (JSON.stringify(params || {})?.includes('../') || JSON.stringify(query || {})?.includes('../') || path?.includes('../')) {
-    logger.file('injection/file', {
-      path, method, params, query, body, message: 'access restricted: 1', uid: user?.uid,
-    });
-    return reply.status(403).send('access restricted: 1');
-  }
-
-  /* === 1.1 File  === */
-  const allowExtPublic = ['.png', '.jpg', '.svg'];
-  const ext = path.toLowerCase().substr(-4);
-  if (path.includes('files/') && allowExtPublic.includes(ext)) return null;
-
-  /* === 2.SQL Injection policy: no-sql === */
-  if (!policy.includes('no-sql')) {
-    // skip polyline param - data filter (geometry bounds)
-    const stopWords = block.filter((el) => path.replace(query.polyline, '').includes(el));
-    if (stopWords?.length) {
-      logger.file('injection/sql', {
-        path, method, params, query, body, stopWords, message: 'access restricted: 2', uid: user?.uid,
-      });
-      return reply.status(403).send('access restricted: 2');
-    }
-  }
-  /* policy: skip if not API */
-  const isApi = ['/files/', '/api/', '/api-user/', '/logger', '/file/'].filter((el) => path.includes(el)).length;
-  if (!isApi) {
-    return null;
-  }
-
-  const validToken = (req.ip === '193.239.152.181' || req.ip === '127.0.0.1' || req.ip?.startsWith?.('192.168.') || config.debug)
-    && req.headers?.token
-    && config.auth?.tokens?.includes?.(headers.token);
-
-  if (validToken && !req?.user?.uid) {
-    req.user = { uid: req.headers?.uid, user_type: (req.ip === '193.239.152.181' || config.debug) ? 'admin' : 'regular' };
-  }
-
-  /* === policy: public === */
-  if (policy.includes('public') || skipCheckPolicy(path) || !config.pg || config.auth?.disable || config.local || config.debug) {
-    return null;
-  }
-
-  /* === 0. policy: unauthorized access from admin URL === */
-  if (!validToken && !user?.uid && isAdmin && !policy.includes('public')) {
-    logger.file('policy/unauthorized', {
-      path, method, params, query, body, token: headers?.token, userId: headers?.uid, ip: req.ip, headers, message: 'unauthorized',
-    });
-    return reply.status(401).send('unauthorized');
-  }
-
-  /* === 3. policy: user === */
-  if (!validToken && !user && policy.includes('user') && !skipCheckPolicy(path)) {
-    logger.file('policy/user', {
-      path, method, params, query, body, message: 'access restricted: 3',
-    });
-    return reply.status(403).send('access restricted: 3');
-  }
-
-  /* === 4. policy: referer === */
-  if (!validToken && !headers?.referer?.includes?.(hostname) && policy.includes('referer')) {
-    logger.file('policy/referer', {
-      path, method, params, query, body, message: 'access restricted: 4', uid: user?.uid,
-    });
-    return reply.status(403).send('access restricted: 4');
-  }
-
-  /* === 5. policy: site auth === */
-  if (!validToken && !policy.includes('site') && !isAdmin) {
-    logger.file('policy/site', {
-      path, method, params, query, body, message: 'access restricted: 5', uid: user?.uid,
-    });
-    return reply.status(403).send('access restricted: 5');
-  }
-
-  /* === 6. base policy: block non-public api w/ out authorization  === */
-  if (!validToken && isAdmin && !isUser && isServer) {
-    logger.file('policy/api', {
-      path, method, params, query, body, message: 'access restricted: 6', uid: user?.uid,
-    });
-    return reply.status(403).send('access restricted: 6');
-  }
-
-  // console.log(headers);
-  return null;
-}

package/server/plugins/policy/funcs/checkXSS.js

@@ -1,37 +0,0 @@
-import config from '../../../../config.js';
-import xssInjection from '../xssInjection.js';
-
-function checkXSS({ body, schema = {} }) {
-  const data = typeof body === 'string' ? body : JSON.stringify(body);
-  const stopWords = xssInjection.filter((el) => data?.toLowerCase?.()?.includes?.(el));
-
-  // check sql injection
-  const stopSpecialSymbols = data.match(/\p{S}OR\p{S}|\p{P}OR\p{P}| OR |\+OR\+/gi);
-  if (stopSpecialSymbols?.length) stopSpecialSymbols?.forEach((el) => stopWords.push(el));
-
-  // escape arrows on non-rich text editor inputs
-  const skipScreening = config.skipScreening || ['Summernote', 'Tiny', 'Ace', 'Texteditor'];
-  Object.keys(body)
-    .filter((key) => ['<', '>'].find((el) => body[key]?.includes?.(el))
-      && !skipScreening.includes(schema?.[key]?.type))
-    ?.forEach((key) => {
-      Object.assign(body, { [key]: body[key].replace(/</g, '&lt;').replace(/>/g, '&gt;') });
-    });
-
-  if (!stopWords.length) return { body };
-
-  const disabledCheckFields = Object.keys(schema || {})?.filter((el) => schema?.[el]?.xssCheck === false); // exclude specific columns
-
-  const field = Object.keys(body)
-    ?.find((key) => body[key]?.toLowerCase
-      && !disabledCheckFields.includes(key)
-      && (skipScreening.includes(schema?.[key]?.type) ? stopWords.find(el => !['href=', 'src='].includes(el)) : true)
-      && body[key].toLowerCase().includes(stopWords[0]));
-  if (field) {
-    console.error(stopWords[0], field, body[field]);
-    return { error: `rule: ${stopWords[0]} | attr: ${field} | val: ${body[field]}`, body };
-  }
-  return { body };
-}
-
-export default checkXSS;

package/server/plugins/policy/index.js

@@ -1,11 +0,0 @@
-import checkPolicy from './funcs/checkPolicy.js';
-
-async function plugin(fastify) {
-  fastify.addHook('preParsing', async (request, reply) => {
-    const resp = checkPolicy(request, reply);
-    if (resp) { return resp; }
-    return null;
-  });
-}
-
-export default plugin;

package/server/plugins/policy/sqlInjection.js

@@ -1,34 +0,0 @@
-/* eslint-disable no-script-url */
-const sqlInjection = [
-  '()',
-  '^',
-  '*',
-  'like ',
-  '@variable',
-  '@@variable',
-  'group by ',
-  'union ',
-  'select ',
-  'having ',
-  'as injectx',
-  'where ',
-  'rlike ',
-  'if(',
-  'sleep(',
-  'waitfor delay',
-  'benchmark(',
-  'pg_sleep(',
-  "'\\\"",
-  'randomblob(',
-  'order by ',
-  'union all ',
-  '+or',
-  'or ',
-  'and ',
-  "'' ",
-  '"""  ',
-  '<script',
-  'javascript:',
-];
-
-export default sqlInjection;

package/server/plugins/policy/xssInjection.js

@@ -1,73 +0,0 @@
-/* eslint-disable no-script-url */
-const xssInjection = [
-  'onkeypress=',
-  'onkeyup=',
-  'ondblclick=',
-  'onerror=',
-  'onmouseover=',
-  '<meta',
-  '<script',
-  'vascript:',
-  'onkeydown=',
-  'onmousedown=',
-  'onmouseenter=',
-  'onmouseleave=',
-  'onmousemove=',
-  'onmouseout=',
-  'onmouseup=',
-  'onmousewheel=',
-  'onpaste=',
-  'onscroll=',
-  'onwheel=',
-  'javascript:',
-  '\\x',
-  'eval(',
-  'onmouseover=',
-  'action=',
-  'xlink:',
-  'allowscriptaccess',
-  'href=',
-  'behavior:',
-  'onreadystatechange=',
-  'onstart=',
-  'offline=',
-  'onabort=',
-  'onafterprint=',
-  'onbeforeonload=',
-  'onbeforeprint=',
-  'onblur=',
-  'oncanplay=',
-  'oncanplaythrough=',
-  'onchange=',
-  'onclick=',
-  'oncontextmenu=',
-  'ondblclick=',
-  'ondrag=',
-  'ondragend=',
-  'ondragenter=',
-  'ondragleave=',
-  'ondragover=',
-  'ondragstart=',
-  'ondrop=',
-  'ondurationchange=',
-  'onemptied=',
-  'onended=',
-  'onerror=',
-  'onfocus=',
-  'onformchange=',
-  'onforminput=',
-  'onhaschange=',
-  'oninput=',
-  'oninvalid=',
-  'onkeydown=',
-  'onkeypress=',
-  'onkeyup=',
-  'onload=',
-  'onloadeddata=',
-  'onloadedmetadata=',
-  'onloadstart=',
-  'alert(',
-  'script:',
-];
-
-export default xssInjection;

package/server/plugins/redis/funcs/getRedis.js

@@ -1,25 +0,0 @@
-/* eslint-disable no-console */
-import Redis from 'ioredis';
-
-import config from '../../../../config.js';
-import redisClients from './redisClients.js';
-
-function getRedis({ db } = { db: 0 }) {
-  if (!config.redis) return null;
-  if (redisClients[db]) return redisClients[db];
-
-  const redisConfig = {
-    db,
-    keyPrefix: `${config.db}:`,
-    host: config.redis?.host || '127.0.0.1',
-    port: config.redis?.port || 6379, // Redis port
-    family: 4, // 4 (IPv4) or 6 (IPv6)
-    closeClient: true,
-  };
-
-  redisClients[db] = new Redis(redisConfig);
-  console.log('redis connected', db);
-  return redisClients[db];
-}
-
-export default getRedis;

package/server/plugins/redis/index.js

@@ -1,17 +0,0 @@
-// import redis from './client.js';
-import redisClients from './funcs/redisClients.js';
-
-function close() {
-  // redis.quit();
-  Object.keys(redisClients).forEach((key) => redisClients[key].quit());
-}
-
-async function plugin(fastify) {
-  // const client = getRedis({ db: 0 });
-  // client.getJSON = client.get;
-  // fastify.decorate('rclient', client);
-  // fastify.decorate('getRedis', getRedis);
-  fastify.addHook('onClose', close);
-}
-
-export default plugin;

package/server/plugins/sqlite/funcs/getSqlite.js

@@ -1,39 +0,0 @@
-import path from 'node:path';
-
-const { name: execName } = path.parse(process.argv0);
-
-// import Database from 'better-sqlite3'; // error with bun
-const { default: Database } = execName === 'bun'
-  ? { default: (await import('bun:sqlite')).Database }
-  : await import('better-sqlite3');
-
-import config from '../../../../config.js';
-import sqliteClients from '../sqliteClients.js';
-import init from './init.js';
-
-function getSqliteAsync({
-  name,
-  readonly = false,
-  fileMustExist = false,
-  statement_timeout: timeout = 10000,
-} = {}) {
-  if (!config.sqlite) return null;
-
-  if (sqliteClients.client?.tlist) {
-    return sqliteClients.client;
-  }
-
-  const dbConfig = {
-    readonly,
-    fileMustExist,
-    timeout,
-    verbose: config.trace ? console.log : undefined,
-  };
-
-  sqliteClients.client = new Database(name || ':memory:', execName === 'bun' ? undefined : dbConfig);
-  init(sqliteClients.client);
-
-  return sqliteClients.client;
-}
-
-export default getSqliteAsync;

package/server/plugins/sqlite/funcs/init.js

@@ -1,53 +0,0 @@
-/* eslint-disable no-console */
-
-function init(client) {
-  if (!client) { return; }
-
-  const rows = client.prepare(`WITH tables AS (
-    SELECT name AS table_name
-    FROM sqlite_master
-    WHERE type = 'table' AND name NOT LIKE 'sqlite_%'
-  ),
-  pk_columns AS (
-    SELECT
-      m.name AS table_name,
-      ti.name AS column_name,
-      ti.pk
-    FROM sqlite_master m
-    JOIN pragma_table_info(m.name) AS ti
-    WHERE ti.pk = 1
-  )
-  SELECT table_name, column_name
-  FROM pk_columns
-  WHERE table_name IN (
-    SELECT table_name
-    FROM pk_columns
-    GROUP BY table_name
-    HAVING COUNT(*) = 1
-  )
-  ORDER BY table_name;`).all();
-
-  const pk = Object.fromEntries(
-    rows.map(row => [row.table_name, row.column_name]),
-  );
-
-  const tlist = client.prepare('SELECT name FROM sqlite_master WHERE type=\'table\' AND name NOT LIKE \'sqlite_%\';').all().reduce((acc, curr) => {
-    acc.push(curr.name);
-    return acc;
-  }, []);
-
-  async function query(q, args = []) {
-    const data = client.prepare(q.replace(/\$\d+/g, '?')).all(...args);
-    return Promise.resolve({ rows: data, rowCount: data.length });
-  }
-
-  Object.assign(client, {
-    query,
-    pk,
-    tlist,
-  });
-
-  console.log('sqlite db connected', client.name || ':memory:');
-}
-
-export default init;

package/server/plugins/sqlite/index.js

@@ -1,11 +0,0 @@
-import fp from 'fastify-plugin';
-
-import sqliteClients from './sqliteClients.js';
-
-async function dbPlugin(app) {
-  app.addHook('onClose', async () => {
-    Object.keys(sqliteClients).forEach(key => sqliteClients[key].close());
-  });
-}
-
-export default fp(dbPlugin);

package/server/plugins/sqlite/sqliteClients.js

@@ -1,26 +0,0 @@
-import path from 'node:path';
-
-const { name: execName } = path.parse(process.argv0);
-
-// import Database from 'better-sqlite3';
-const { default: Database } = execName === 'bun'
-  ? { default: (await import('bun:sqlite')).Database }
-  : await import('better-sqlite3');
-
-import config from '../../../config.js';
-import init from './funcs/init.js';
-
-const sqliteClients = {};
-
-if (config.sqlite) {
-  const client = new Database(config.sqlite?.name || ':memory:', execName === 'bun' ? undefined : {
-    readonly: config.sqlite?.readonly || false,
-    fileMustExist: config.sqlite?.fileMustExist || false,
-    timeout: config.sqlite?.statement_timeout || 10000,
-    verbose: config.trace ? console.log : undefined,
-  });
-  client.init = () => init(client);
-  client.init();
-  sqliteClients.client = client;
-}
-export default sqliteClients;

package/server/plugins/table/funcs/addMenu.js

@@ -1,16 +0,0 @@
-import { basename } from 'node:path';
-import { existsSync } from 'node:fs';
-
-import menuDirs from './menuDirs.js';
-
-export default function addMenu(filepath) {
-    if (basename(filepath) !== 'menu.json') {
-        throw new Error('addMenu: filepath must be a menu.json file');
-    }
-
-    if (filepath && !menuDirs.includes(filepath) && existsSync(filepath)) {
-        menuDirs.push(filepath);
-    }
-
-  return menuDirs;
-}