@opengis/fastify-table 1.4.88 → 1.5.0

package/dist/server/plugins/pg/funcs/init.js

@@ -0,0 +1,157 @@
+import { createHash } from "node:crypto";
+import config from "../../../../config.js";
+import getRedis from "../../redis/funcs/getRedis.js";
+import logger from "../../logger/getLogger.js";
+const rclient = getRedis({ db: 0 });
+async function init(client) {
+    if (!client?.options?.database) {
+        return;
+    }
+    const { pgType, pk } = await client
+        .query(`SELECT
+        (
+          SELECT
+            json_object_agg(
+              conrelid:: regclass,
+              (
+                SELECT
+                  attname
+                FROM
+                  pg_attribute
+                WHERE
+                  attrelid = c.conrelid
+                  AND attnum = c.conkey [1]
+              )
+            )
+          FROM
+            pg_constraint c
+          WHERE
+            contype = 'p'
+            AND connamespace:: regnamespace:: text NOT IN ('sde')
+        ) AS pk,
+        (
+          SELECT
+            json_object_agg(t.oid:: text, pg_catalog.format_type(t.oid, NULL))
+          FROM
+            pg_catalog.pg_type t
+        ) AS "pgType"`)
+        .then((d) => d.rows[0]);
+    const tlist = await client
+        .query(`SELECT
+        array_agg(
+          (
+            SELECT
+              nspname
+            FROM
+              pg_namespace
+            WHERE
+              oid = relnamespace
+          ) || '.' || relname
+        ) tlist
+      FROM
+        pg_class
+      WHERE
+        relkind IN ('r', 'v')`)
+        .then((d) => d.rows[0].tlist);
+    const { rows = [] } = await client.query(`SELECT
+      (
+        SELECT
+          nspname
+        FROM
+          pg_namespace
+        WHERE
+          oid = relnamespace
+      ) || '.' || relname AS tname,
+      relkind
+    FROM
+      pg_class
+    WHERE
+      relkind IN ('r', 'v')`);
+    const relkinds = rows.reduce((acc, curr) => Object.assign(acc, { [curr.tname]: curr.relkind }), {});
+    async function query(q, args = [], isstream = false) {
+        try {
+            if (isstream) {
+                await client.query("set statement_timeout to 100000000");
+            }
+            const data = await client.query(q, args);
+            await client.query("set statement_timeout to 0");
+            return data;
+        }
+        catch (err) {
+            await client.query("set statement_timeout to 0");
+            if (err.message === "canceling statement due to statement timeout") {
+                logger.file("timeout/query", { q, stack: err.stack });
+                return { rows: [], timeout: true };
+            }
+            throw new Error(err);
+        }
+    }
+    async function querySafe(q, param) {
+        const args = Array.isArray(param) ? param : param?.args || [];
+        const data = await query(q, args, true);
+        return data;
+    }
+    async function one(q, param) {
+        const data = await query(q, Array.isArray(param) ? param : param?.args || []);
+        const result = ((Array.isArray(data) ? data.pop() : data)?.rows || [])[0] || {};
+        return result;
+    }
+    async function queryNotice(q, args, cb = () => { }) {
+        const clientCb = await client.connect();
+        clientCb.on("notice", (e) => {
+            cb(e.message);
+        });
+        let result;
+        try {
+            result = await clientCb.query(q, args);
+            clientCb.release();
+        }
+        catch (err) {
+            clientCb.release();
+            cb(err.toString(), 1);
+            throw err;
+        }
+        // client.end();
+        return result;
+    }
+    async function queryCache(q, param) {
+        const { table, args = [], time = 15 } = param || {};
+        const seconds = typeof time !== "number" || time < 0 ? 0 : time * 60;
+        if (seconds === 0 || config.disableCache) {
+            const data = await query(q, args || []);
+            return data;
+        }
+        // CRUD table state
+        const keyCacheTable = `pg:${table}:crud`;
+        const crudInc = table && config.redis ? (await rclient.get(keyCacheTable)) || 0 : 0;
+        //
+        const hash = createHash("sha1")
+            .update([q, JSON.stringify(args)].join())
+            .digest("base64");
+        const keyCache = `pg:${hash}:${crudInc}`;
+        const cacheData = config.redis ? await rclient.get(keyCache) : null;
+        if (cacheData && !config.local) {
+            // console.log('from cache', table, query);
+            return JSON.parse(cacheData);
+        }
+        const data = await query(q, args || []);
+        if (seconds > 0 && config.redis) {
+            rclient.set(keyCache, JSON.stringify(data), "EX", seconds);
+        }
+        // console.log('no cache', table, crudInc, query);
+        return data;
+    }
+    Object.assign(client, {
+        one,
+        pgType,
+        pk,
+        tlist,
+        relkinds,
+        queryCache,
+        queryNotice,
+        querySafe,
+    });
+    console.log("pg connected", client.options?.database);
+}
+// export default client;
+export default init;

package/dist/server/plugins/pg/index.js

@@ -0,0 +1,47 @@
+import pgClients from "./pgClients.js";
+import getPGAsync from "./funcs/getPGAsync.js";
+import logger from "../logger/getLogger.js";
+function close() {
+    Object.keys(pgClients).forEach((el) => {
+        pgClients[el].end();
+    });
+}
+async function getHeadersPG(req, config) {
+    if (!req.headers?.token)
+        return null;
+    const validToken = (req.ip === "193.239.152.181" ||
+        req.ip === "127.0.0.1" ||
+        req.ip.startsWith("192.168.") ||
+        config.debug) &&
+        req.headers?.token &&
+        config.auth?.tokens?.includes?.(req.headers.token);
+    if (validToken && typeof req.headers?.db === "string") {
+        const pg = pgClients[req.headers.db] || (await getPGAsync(req.headers.db));
+        return pg;
+    }
+    return null;
+}
+async function plugin(fastify, config) {
+    const client = await getPGAsync({ ...(config.pg || {}), name: "client" });
+    fastify.addHook("onRequest", async (req) => {
+        const headersPG = await getHeadersPG(req, config);
+        req.pg = headersPG || req.pg || client || pgClients.client;
+        if (headersPG) {
+            req.user = { uid: req.headers?.uid };
+            req.folder = config.folder;
+            req.root = config.root;
+        }
+    });
+    fastify.addHook("onError", async (req, reply, err) => {
+        if (err.message === "canceling statement due to statement timeout") {
+            logger.file("timeout/request", {
+                method: req.method,
+                url: req.url,
+                referer: req.headers?.referer,
+                stack: err.stack,
+            });
+        }
+    });
+    fastify.addHook("onClose", close);
+}
+export default plugin;

package/dist/server/plugins/pg/pgClients.js

@@ -0,0 +1,20 @@
+import pg from "pg";
+import config from "../../../config.js";
+import init from "./funcs/init.js";
+const pgClients = {};
+if (config.pg) {
+    const client = new pg.Pool({
+        host: config.pg?.host || "127.0.0.1",
+        port: config.pg?.port || 5432,
+        database: config.pg?.database || "postgres",
+        user: config.pg?.user || "postgres",
+        password: config.pg?.password || "postgres",
+        statement_timeout: config.pg?.statement_timeout || 10000,
+    });
+    client.init = async () => {
+        await init(client);
+    };
+    client.init();
+    pgClients.client = client;
+}
+export default pgClients;

package/dist/server/plugins/policy/funcs/checkPolicy.js

@@ -0,0 +1,173 @@
+import { config, logger } from "../../../../utils.js";
+import block from "../sqlInjection.js";
+const { skipCheckPolicyRoutes = [] } = config;
+const skipCheckPolicy = (path) => skipCheckPolicyRoutes.find((el) => path.includes(el));
+export default function checkPolicy(req, reply) {
+    const { originalUrl: path, hostname, query, params, headers, method, routeOptions, unittest, } = req;
+    if (config.local || unittest || config.env === "test") {
+        return null;
+    }
+    const body = JSON.stringify(req?.body || {}).substring(30);
+    const isAdmin = process.env.NODE_ENV === "admin" ||
+        hostname.split(":").shift() === config.adminDomain ||
+        config.admin ||
+        hostname.startsWith("admin");
+    const user = req.user || req.session?.passport?.user;
+    const isUser = config?.debug || !!user;
+    const isServer = process.argv[2];
+    const { policy = [] } = (routeOptions?.config ||
+        {});
+    /*= == 0.Check superadmin access  === */
+    if (policy.includes("admin") &&
+        user?.user_type !== "admin" &&
+        !config.auth?.disable) {
+        logger.file("policy/access", {
+            path,
+            method,
+            params,
+            query,
+            body,
+            message: "access restricted: not admin",
+            uid: user?.uid,
+        });
+        return reply.status(403).send("access restricted: 0");
+    }
+    /*= == 1.File injection  === */
+    if (JSON.stringify(params || {})?.includes("../") ||
+        JSON.stringify(query || {})?.includes("../") ||
+        path?.includes("../")) {
+        logger.file("injection/file", {
+            path,
+            method,
+            params,
+            query,
+            body,
+            message: "access restricted: 1",
+            uid: user?.uid,
+        });
+        return reply.status(403).send("access restricted: 1");
+    }
+    /* === 1.1 File  === */
+    const allowExtPublic = [".png", ".jpg", ".svg"];
+    const ext = path.toLowerCase().substr(-4);
+    if (path.includes("files/") && allowExtPublic.includes(ext))
+        return null;
+    /* === 2.SQL Injection policy: no-sql === */
+    if (!policy.includes("no-sql")) {
+        // skip polyline param - data filter (geometry bounds)
+        const stopWords = block.filter((el) => path.replace(query.polyline, "").includes(el));
+        if (stopWords?.length) {
+            logger.file("injection/sql", {
+                path,
+                method,
+                params,
+                query,
+                body,
+                stopWords,
+                message: "access restricted: 2",
+                uid: user?.uid,
+            });
+            return reply.status(403).send("access restricted: 2");
+        }
+    }
+    /* policy: skip if not API */
+    const isApi = ["/files/", "/api/", "/api-user/", "/logger", "/file/"].filter((el) => path.includes(el)).length;
+    if (!isApi) {
+        return null;
+    }
+    const validToken = (req.ip === "193.239.152.181" ||
+        req.ip === "127.0.0.1" ||
+        req.ip?.startsWith?.("192.168.") ||
+        config.debug) &&
+        req.headers?.token &&
+        config.auth?.tokens?.includes?.(headers.token);
+    if (validToken && !req?.user?.uid) {
+        req.user = {
+            uid: req.headers?.uid?.toString?.(),
+            user_type: req.ip === "193.239.152.181" || config.debug ? "admin" : "regular",
+        };
+    }
+    /* === policy: public === */
+    if (policy.includes("public") ||
+        skipCheckPolicy(path) ||
+        !config.pg ||
+        config.auth?.disable ||
+        config.local ||
+        config.debug) {
+        return null;
+    }
+    /* === 0. policy: unauthorized access from admin URL === */
+    if (!validToken && !user?.uid && isAdmin && !policy.includes("public")) {
+        logger.file("policy/unauthorized", {
+            path,
+            method,
+            params,
+            query,
+            body,
+            token: headers?.token,
+            userId: headers?.uid,
+            ip: req.ip,
+            headers,
+            message: "unauthorized",
+        });
+        return reply.status(401).send("unauthorized");
+    }
+    /* === 3. policy: user === */
+    if (!validToken &&
+        !user &&
+        policy.includes("user") &&
+        !skipCheckPolicy(path)) {
+        logger.file("policy/user", {
+            path,
+            method,
+            params,
+            query,
+            body,
+            message: "access restricted: 3",
+        });
+        return reply.status(403).send("access restricted: 3");
+    }
+    /* === 4. policy: referer === */
+    if (!validToken &&
+        !headers?.referer?.includes?.(hostname) &&
+        policy.includes("referer")) {
+        logger.file("policy/referer", {
+            path,
+            method,
+            params,
+            query,
+            body,
+            message: "access restricted: 4",
+            uid: user?.uid,
+        });
+        return reply.status(403).send("access restricted: 4");
+    }
+    /* === 5. policy: site auth === */
+    if (!validToken && !policy.includes("site") && !isAdmin) {
+        logger.file("policy/site", {
+            path,
+            method,
+            params,
+            query,
+            body,
+            message: "access restricted: 5",
+            uid: user?.uid,
+        });
+        return reply.status(403).send("access restricted: 5");
+    }
+    /* === 6. base policy: block non-public api w/ out authorization  === */
+    if (!validToken && isAdmin && !config.debug && user?.uid && isServer) {
+        logger.file("policy/api", {
+            path,
+            method,
+            params,
+            query,
+            body,
+            message: "access restricted: 6",
+            uid: user?.uid,
+        });
+        return reply.status(403).send("access restricted: 6");
+    }
+    // console.log(headers);
+    return null;
+}

package/dist/server/plugins/policy/funcs/checkXSS.js

@@ -0,0 +1,44 @@
+import config from "../../../../config.js";
+import xssInjection from "../xssInjection.js";
+function checkXSS({ body, schema = {} }) {
+    const data = typeof body === "string" ? body : JSON.stringify(body);
+    const stopWords = xssInjection.filter((el) => data?.toLowerCase?.()?.includes?.(el));
+    // check sql injection
+    const stopSpecialSymbols = data.match(/\p{S}OR\p{S}|\p{P}OR\p{P}| OR |\+OR\+/giu);
+    if (stopSpecialSymbols?.length) {
+        stopSpecialSymbols?.forEach((el) => stopWords.push(el));
+    }
+    // escape arrows on non-rich text editor inputs
+    const skipScreening = config.skipScreening || [
+        "Summernote",
+        "Tiny",
+        "Ace",
+        "Texteditor",
+    ];
+    Object.keys(body)
+        .filter((key) => ["<", ">"].find((el) => body[key]?.includes?.(el)) &&
+        !skipScreening.includes(schema?.[key]?.type))
+        ?.forEach((key) => {
+        Object.assign(body, {
+            [key]: body[key].replace(/</g, "&lt;").replace(/>/g, "&gt;"),
+        });
+    });
+    if (!stopWords.length)
+        return { body };
+    const disabledCheckFields = Object.keys(schema || {})?.filter((el) => schema?.[el]?.xssCheck === false); // exclude specific columns
+    const field = Object.keys(body)?.find((key) => body[key]?.toLowerCase &&
+        !disabledCheckFields.includes(key) &&
+        (skipScreening.includes(schema?.[key]?.type)
+            ? stopWords.find((el) => !["href=", "src="].includes(el))
+            : true) &&
+        body[key].toLowerCase().includes(stopWords[0]));
+    if (field) {
+        console.error(stopWords[0], field, body[field]);
+        return {
+            error: `rule: ${stopWords[0]} | attr: ${field} | val: ${body[field]}`,
+            body,
+        };
+    }
+    return { body };
+}
+export default checkXSS;

package/dist/server/plugins/policy/index.js

@@ -0,0 +1,11 @@
+import checkPolicy from './funcs/checkPolicy.js';
+async function plugin(fastify) {
+    fastify.addHook('preParsing', async (request, reply) => {
+        const resp = checkPolicy(request, reply);
+        if (resp) {
+            return resp;
+        }
+        return null;
+    });
+}
+export default plugin;

package/dist/server/plugins/policy/sqlInjection.js

@@ -0,0 +1,33 @@
+/* eslint-disable no-script-url */
+const sqlInjection = [
+    '()',
+    '^',
+    '*',
+    'like ',
+    '@variable',
+    '@@variable',
+    'group by ',
+    'union ',
+    'select ',
+    'having ',
+    'as injectx',
+    'where ',
+    'rlike ',
+    'if(',
+    'sleep(',
+    'waitfor delay',
+    'benchmark(',
+    'pg_sleep(',
+    "'\\\"",
+    'randomblob(',
+    'order by ',
+    'union all ',
+    '+or',
+    'or ',
+    'and ',
+    "'' ",
+    '"""  ',
+    '<script',
+    'javascript:',
+];
+export default sqlInjection;

package/dist/server/plugins/policy/xssInjection.js

@@ -0,0 +1,72 @@
+/* eslint-disable no-script-url */
+const xssInjection = [
+    'onkeypress=',
+    'onkeyup=',
+    'ondblclick=',
+    'onerror=',
+    'onmouseover=',
+    '<meta',
+    '<script',
+    'vascript:',
+    'onkeydown=',
+    'onmousedown=',
+    'onmouseenter=',
+    'onmouseleave=',
+    'onmousemove=',
+    'onmouseout=',
+    'onmouseup=',
+    'onmousewheel=',
+    'onpaste=',
+    'onscroll=',
+    'onwheel=',
+    'javascript:',
+    '\\x',
+    'eval(',
+    'onmouseover=',
+    'action=',
+    'xlink:',
+    'allowscriptaccess',
+    'href=',
+    'behavior:',
+    'onreadystatechange=',
+    'onstart=',
+    'offline=',
+    'onabort=',
+    'onafterprint=',
+    'onbeforeonload=',
+    'onbeforeprint=',
+    'onblur=',
+    'oncanplay=',
+    'oncanplaythrough=',
+    'onchange=',
+    'onclick=',
+    'oncontextmenu=',
+    'ondblclick=',
+    'ondrag=',
+    'ondragend=',
+    'ondragenter=',
+    'ondragleave=',
+    'ondragover=',
+    'ondragstart=',
+    'ondrop=',
+    'ondurationchange=',
+    'onemptied=',
+    'onended=',
+    'onerror=',
+    'onfocus=',
+    'onformchange=',
+    'onforminput=',
+    'onhaschange=',
+    'oninput=',
+    'oninvalid=',
+    'onkeydown=',
+    'onkeypress=',
+    'onkeyup=',
+    'onload=',
+    'onloadeddata=',
+    'onloadedmetadata=',
+    'onloadstart=',
+    'alert(',
+    'script:',
+];
+export default xssInjection;

package/{server → dist/server}/plugins/redis/client.js

@@ -1,8 +1,6 @@
-import redisClients from './funcs/redisClients.js';
-import getRedis from './funcs/getRedis.js';
-
-if (!redisClients[0]) {
-  getRedis({ db: 0 });
-}
-
-export default redisClients[0];
+import redisClients from './funcs/redisClients.js';
+import getRedis from './funcs/getRedis.js';
+if (!redisClients[0]) {
+    getRedis({ db: 0 });
+}
+export default redisClients[0];

package/dist/server/plugins/redis/funcs/getRedis.js

@@ -0,0 +1,23 @@
+/* eslint-disable no-console */
+import { Redis } from "ioredis";
+// import Redis from 'ioredis';
+import config from "../../../../config.js";
+import redisClients from "./redisClients.js";
+function getRedis({ db } = { db: 0 }) {
+    if (!config.redis)
+        return null;
+    if (redisClients[db])
+        return redisClients[db];
+    const redisConfig = {
+        db,
+        keyPrefix: `${config.db}:`,
+        host: config.redis?.host || "127.0.0.1",
+        port: config.redis?.port || 6379, // Redis port
+        family: 4, // 4 (IPv4) or 6 (IPv6)
+        closeClient: true,
+    };
+    redisClients[db] = new Redis(redisConfig);
+    console.log("redis connected", db);
+    return redisClients[db];
+}
+export default getRedis;

package/{server → dist/server}/plugins/redis/funcs/redisClients.js

@@ -1,3 +1,2 @@
-const redisClients = {};
-
-export default redisClients;
+const redisClients = {};
+export default redisClients;

package/dist/server/plugins/redis/index.js

@@ -0,0 +1,8 @@
+import redisClients from "./funcs/redisClients.js";
+function close() {
+    Object.keys(redisClients).forEach((key) => redisClients[key].quit());
+}
+async function plugin(fastify) {
+    fastify.addHook("onClose", close);
+}
+export default plugin;

package/dist/server/plugins/sqlite/funcs/getSqlite.js

@@ -0,0 +1,27 @@
+import path from "node:path";
+const { name: execName } = path.parse(process.argv0);
+// import Database from 'better-sqlite3'; // error with bun
+const { default: Database } = execName === "bun"
+    ? // @ts-expect-error bun internal module
+        { default: (await import("bun:sqlite")).Database }
+    : await import("better-sqlite3");
+import config from "../../../../config.js";
+import sqliteClients from "../sqliteClients.js";
+import init from "./init.js";
+function getSqliteAsync({ name, readonly = false, fileMustExist = false, statement_timeout: timeout = 10000, } = {}) {
+    if (!config.sqlite)
+        return null;
+    if (sqliteClients.client?.tlist) {
+        return sqliteClients.client;
+    }
+    const dbConfig = {
+        readonly,
+        fileMustExist,
+        timeout,
+        verbose: config.trace ? console.log : undefined,
+    };
+    sqliteClients.client = new Database(name || ":memory:", execName === "bun" ? undefined : dbConfig);
+    init(sqliteClients.client);
+    return sqliteClients.client;
+}
+export default getSqliteAsync;