@opengis/fastify-table 1.4.88 → 1.5.0

package/{server/routes/access/schema.mjs → dist/server/routes/access/schema.js}

@@ -1,68 +1,65 @@
-export default null;
-export { accessGroupSchema, accessGroupPostSchema, accessInterfaceSchema }
-
-const accessGroupSchema = {
-    params: {
-        type: 'object',
-        properties: {
-            id: { type: 'string', pattern: '^([\\d\\w._-]+)$' },
-        },
-        required: ['id'],
-    },
-};
-
-const accessInterfaceSchema = {
-    params: {
-        type: 'object',
-        properties: {
-            name: { type: 'string', pattern: '^([\\d\\w._-]+)$' },
-        },
-        required: ['name'],
-    },
-};
-
-const accessGroupPostSchema = {
-    params: {
-        type: 'object',
-        properties: {
-            id: { type: 'string', pattern: '^([\\d\\w._-]+)$' },
-        },
-        required: ['id'],
-    },
-    body: {
-        type: 'object',
-        properties: {
-            users: {
-                type: 'array',
-                items: {
-                    type: 'object',
-                    properties: {
-                        id: {
-                            type: 'string',
-                            pattern: '^([\\d\\w._-]+)$',
-                        },
-                    },
-                },
-            },
-            routes: {
-                type: 'array',
-                /*items: {
-                    type: 'object',
-                    properties: {
-                        path: {
-                            type: 'string',
-                            pattern: '^([\\d\\w._-]+)$',
-                        },
-                        actions: {
-                            type: 'array',
-                            items: {
-                                type: 'string',
-                                enum: ['get', 'add', 'edit', 'del'],
-                            },
-                        },
-                    },
-                },*/
-            },
-        },
-    },
-};
+export default null;
+export { accessGroupSchema, accessGroupPostSchema, accessInterfaceSchema };
+const accessGroupSchema = {
+    params: {
+        type: 'object',
+        properties: {
+            id: { type: 'string', pattern: '^([\\d\\w._-]+)$' },
+        },
+        required: ['id'],
+    },
+};
+const accessInterfaceSchema = {
+    params: {
+        type: 'object',
+        properties: {
+            name: { type: 'string', pattern: '^([\\d\\w._-]+)$' },
+        },
+        required: ['name'],
+    },
+};
+const accessGroupPostSchema = {
+    params: {
+        type: 'object',
+        properties: {
+            id: { type: 'string', pattern: '^([\\d\\w._-]+)$' },
+        },
+        required: ['id'],
+    },
+    body: {
+        type: 'object',
+        properties: {
+            users: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        id: {
+                            type: 'string',
+                            pattern: '^([\\d\\w._-]+)$',
+                        },
+                    },
+                },
+            },
+            routes: {
+                type: 'array',
+                /*items: {
+                    type: 'object',
+                    properties: {
+                        path: {
+                            type: 'string',
+                            pattern: '^([\\d\\w._-]+)$',
+                        },
+                        actions: {
+                            type: 'array',
+                            items: {
+                                type: 'string',
+                                enum: ['get', 'add', 'edit', 'del'],
+                            },
+                        },
+                    },
+                },*/
+            },
+        },
+    },
+};

package/dist/server/routes/cron/controllers/cronApi.js

@@ -0,0 +1,16 @@
+import cronList from "../../../plugins/cron/cronList.js";
+export default async function cronApi(req) {
+    const { params = {}, user = {}, hostname } = req;
+    if ((!user.uid || !user.user_type?.includes("admin")) &&
+        !hostname?.includes("local")) {
+        return { message: "access restricted", status: 403 };
+    }
+    if (params.name === "list") {
+        return { data: Object.keys(cronList || {}) };
+    }
+    if (!cronList[params.name]) {
+        return { message: `cron not found: ${params.name}`, status: 404 };
+    }
+    const result = await cronList[params.name]?.(req);
+    return result;
+}

package/dist/server/routes/cron/index.js

@@ -0,0 +1,15 @@
+import cronApi from "./controllers/cronApi.js";
+const cronSchema = {
+    type: "object",
+    properties: {
+        params: {
+            name: { type: "string", pattern: "^([\\d\\w._-]+)$" },
+        },
+    },
+};
+const policy = ["site", "admin"];
+async function plugin(app, config = { prefix: "/api" }) {
+    const { prefix = "/api" } = config;
+    app.get(`${prefix}/cron/:name`, { config: { policy }, schema: cronSchema }, cronApi);
+}
+export default plugin;

package/dist/server/routes/crud/controllers/deleteCrud.js

@@ -0,0 +1,90 @@
+import { dataDelete, getTemplate, getAccess, applyHook, getToken, config, pgClients, getOpt, } from "../../../../utils.js";
+export default async function deleteCrud(req, reply) {
+    const { pg = pgClients.client, user = {}, params = {}, headers = {}, } = req || {};
+    const hookData = (await applyHook("preDelete", {
+        pg,
+        table: params?.table,
+        id: params?.id,
+        user,
+    }));
+    if (hookData?.message && hookData?.status) {
+        return reply.status(hookData.status).send(hookData.message);
+    }
+    const { referer } = headers;
+    const tokenData = (await getToken({
+        uid: user.uid,
+        token: params.id || params.table,
+        json: 1,
+    })) ||
+        (await getOpt(params.id || params.table, user.uid)) ||
+        (await getOpt(params.table, user.uid));
+    const { table: del, id = params.id, query, actions: actionsToken, } = hookData ||
+        tokenData ||
+        (config.security?.disableToken || config.local || config.auth?.disable
+            ? req.params
+            : {});
+    if (actionsToken && !actionsToken?.includes("del")) {
+        return reply.status(403).send({
+            error: "del is not allowed ",
+            code: 403,
+        });
+    }
+    const { actions = [] } = (await getAccess({ table: del, id, user }, pg)) || {};
+    if (!tokenData &&
+        !config?.local &&
+        !config.security?.disableToken &&
+        !config.auth?.disable) {
+        return reply.status(403).send({
+            error: "invalid token",
+            code: 403,
+        });
+    }
+    if (!actions.includes("del") && !config?.local && !tokenData) {
+        return reply.status(403).send({
+            error: "access restricted: actions",
+            code: 403,
+        });
+    }
+    const loadTemplate = await getTemplate("table", del);
+    const { table } = loadTemplate || hookData || tokenData || req.params || {};
+    if (!table) {
+        return reply.status(404).send({
+            error: "table is required",
+            code: 404,
+        });
+    }
+    if (!id) {
+        return reply.status(404).send({
+            error: "id is required",
+            code: 404,
+        });
+    }
+    const data = await dataDelete({
+        pg,
+        table,
+        id,
+        uid: user?.uid,
+        tokenData,
+        referer,
+        query,
+    }).catch((err) => {
+        if (err.message?.includes?.("foreign key") ||
+            err.message?.includes?.("unique")) {
+            const constraint = err.message.match(/constraint "([^"]+)"/g);
+            return reply.status(400).send({
+                error: `Видалення заборонено для збереження цілісності БД: ${constraint}`,
+                code: 400,
+            });
+        }
+        if (config.trace)
+            console.error(err.toString());
+        return {
+            error: err.toString(),
+            code: 400,
+        };
+    });
+    return reply.status(200).send({
+        rowCount: data?.rowCount || 0,
+        msg: !data?.rowCount ? data : null,
+    });
+}

package/dist/server/routes/crud/controllers/insert.js

@@ -0,0 +1,110 @@
+import { applyHook, getAccess, getTemplate, checkXSS, dataInsert, getToken, config, pgClients, logger, validateData, } from "../../../../utils.js";
+export default async function insert(req, reply) {
+    const { pg = pgClients.client, user = {}, params = {}, body = {}, headers = {}, } = req || {};
+    if (!user) {
+        return reply.status(403).send("access restricted");
+    }
+    const hookData = (await applyHook("preInsert", {
+        pg,
+        table: params?.table,
+        user,
+        body,
+    }));
+    if (hookData?.message && hookData?.status) {
+        return { message: hookData?.message, status: hookData?.status };
+    }
+    const { referer } = headers;
+    const tokenData = await getToken({
+        uid: user?.uid,
+        token: params.table,
+        mode: "a",
+        json: 1,
+    });
+    const { form, table: add } = hookData ||
+        tokenData ||
+        (config.security?.disableToken || config.local || config.auth?.disable
+            ? req.params
+            : {});
+    const { actions = [] } = (await getAccess({ table: add, form, user }, pg)) || {};
+    if (!tokenData &&
+        !config.local &&
+        !config.security?.disableToken &&
+        !config.auth?.disable) {
+        return reply.status(400).send("invalid token");
+    }
+    if (!actions.includes("add") && !config.local && !tokenData) {
+        return reply.status(403).send("access restricted: actions");
+    }
+    if (!add) {
+        return reply.status(400).send("table is required");
+    }
+    const loadTemplate = await getTemplate("table", add);
+    const { table } = loadTemplate || hookData || tokenData || req.params || {};
+    if (!table) {
+        return reply.status(404).send("table not found");
+    }
+    const formData = form || loadTemplate?.form
+        ? (await getTemplate("form", form || loadTemplate?.form)) || {}
+        : {};
+    const schema = formData?.schema || formData;
+    const xssCheck = checkXSS({ body, schema });
+    if (xssCheck.error && formData?.xssCheck !== false) {
+        logger.file("injection/xss", {
+            table,
+            form: form || loadTemplate?.form,
+            body,
+            uid: user?.uid,
+            msg: xssCheck.error,
+        });
+        return reply
+            .status(409)
+            .send("Дані містять заборонені символи. Приберіть їх та спробуйте ще раз");
+    }
+    const fieldCheck = validateData({ body, schema });
+    if (fieldCheck.error) {
+        logger.file("injection/sql", {
+            table,
+            form: form || loadTemplate?.form,
+            uid: user?.uid,
+            ...fieldCheck,
+        });
+        return reply
+            .status(409)
+            .send("Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз");
+    }
+    if (![add, table].includes("admin.users")) {
+        Object.assign(body, { uid: user?.uid, editor_id: user?.uid });
+    }
+    if (tokenData?.obj) {
+        const objData = tokenData.obj?.split("#").reduce((p, el) => ({
+            ...p,
+            [el.split("=")[0] || ""]: el.split("=")[1],
+        }), {}) || {};
+        Object.assign(body, objData);
+    }
+    const res = await dataInsert({
+        pg,
+        id: params?.id || body.id,
+        table: loadTemplate?.table || table,
+        data: body,
+        uid: user?.uid,
+        tokenData,
+        referer,
+    });
+    if (!res) {
+        return reply.status(400).send("nothing added");
+    }
+    // admin.custom_column
+    await applyHook("afterInsert", {
+        pg,
+        table,
+        token: params?.table,
+        body,
+        payload: res,
+        user,
+    });
+    const pk = pg.pk?.[loadTemplate?.table || table];
+    return reply
+        .status(200)
+        .send({ id: res?.rows?.[0]?.[pk], rows: res.rows, extra: res.extra });
+}

package/dist/server/routes/crud/controllers/table.js

@@ -0,0 +1,144 @@
+import { config, getAccess, getTemplate, getMeta, setToken, applyHook, getToken, pgClients, } from "../../../../utils.js";
+import extraDataGet from "../../../plugins/extra/extraDataGet.js";
+export default async function tableAPI(req, reply, called) {
+    const { pg = pgClients.client, params, user = {}, query = {} } = req;
+    const tokenData = (await getToken({ token: params?.table, uid: user.uid, json: 1 })) || {};
+    const hookData = (await applyHook("preTable", {
+        pg,
+        table: params?.table,
+        id: params?.id,
+        ...(tokenData || {}),
+        user,
+    }));
+    if (hookData?.message && hookData?.status) {
+        return reply.status(hookData?.status).send(hookData?.message);
+    }
+    const templateName = hookData?.table || tokenData.table || params.table;
+    const loadTable = await getTemplate("table", templateName);
+    if (!loadTable &&
+        !pg.pk?.[tokenData.table] &&
+        !(pg.pk?.[templateName] && called)) {
+        return reply.status(404).send("not found");
+    }
+    const { table = params.table, /* columns, */ form } = hookData || loadTable || tokenData;
+    const id = hookData?.id || tokenData.id || params.id;
+    if (tokenData && !id)
+        return { message: {} };
+    if (!table && !id) {
+        return reply.status(400).send("not enough params");
+    }
+    const { actions = [], query: accessQuery } = (await getAccess({
+        table,
+        form,
+        id,
+        user,
+    }, pg)) || {};
+    if (!tokenData &&
+        !config?.local &&
+        !config.security?.disableToken &&
+        !called) {
+        return reply.status(400).send("invalid token");
+    }
+    if (!actions.includes("edit") && !config?.local && !tokenData && !called) {
+        return reply.status(403).send("access restricted: actions");
+    }
+    const { pk, columns: dbColumns = [] } = await getMeta({ pg, table });
+    if (!pk) {
+        return reply.status(404).send(`table not found: ${table}`);
+    }
+    // const cols = columns.map((el) => el.name || el).join(',');
+    const formData = (await getTemplate("form", form)) || {};
+    const schema = formData?.schema || formData || {};
+    // skip DataTable from another table
+    const extraKeys = Object.keys(schema).filter((key) => schema[key]?.table &&
+        schema[key]?.parent_id &&
+        Object.hasOwn(schema[key], "colModel"));
+    // skip non-existing columns
+    const columnList = dbColumns.map((el) => el.name || el).join(",");
+    const { fields = [] } = !loadTable?.table
+        ? await pg.query(`select * from ${table} limit 0`)
+        : {};
+    const cols = loadTable?.table
+        ? Object.keys(schema || {})
+            .filter((col) => columnList.includes(col) && !extraKeys.includes(col))
+            ?.map((col) => col?.includes("geom") && schema?.[col]?.type === "Geom"
+            ? `st_asgeojson(${col})::json as "${col}"`
+            : `"${col}"`)
+            ?.join(",")
+        : fields
+            .map((el) => el?.name?.includes("geom") && pg.pgType[el?.dataTypeID] === "geometry"
+            ? `st_asgeojson(${el.name})::json as "${el.name}"`
+            : `"${el?.name}"`)
+            .join(",");
+    const where = [`"${pk}" = $1`, loadTable?.query, accessQuery]
+        .filter(Boolean)
+        .filter((el) => user?.user_type === "superadmin" ? !el.includes("{{uid}}") : true);
+    const geom = dbColumns.find((el) => el.name === "geom" && pg.pgType[el.dataTypeID] === "geometry")
+        ? ",st_asgeojson(geom)::json as geom"
+        : "";
+    const q = `select "${pk}" as id, ${cols || "*"} ${geom} from ${table} t where ${where.join(" and ") || "true"} limit 1`;
+    if (query?.sql === "1") {
+        const extraQ = extraKeys
+            ?.map((key) => {
+            const { colModel, table: extraTable, parent_id: parentId, } = schema[key];
+            const colModel1 = Array.isArray(colModel)
+                ? colModel
+                : Object.values(colModel || {});
+            return colModel1.length
+                ? `/*${key}*/ select ${parentId} as parent, ${colModel1
+                    .map((col) => col.name || col.key)
+                    .join(",")} from ${extraTable} a where ${parentId}::text=$1`
+                : null;
+        })
+            .filter((el) => el)
+            .join(";");
+        return `${q};${extraQ || ""}`.replace(/\$1/g, `'${id}'`);
+    }
+    const data = await pg
+        .query(q.replace(/{{uid}}/, user?.uid), [id])
+        .then((el) => el.rows[0]);
+    if (!data) {
+        return reply.status(404).send(`object not found: ${id}`);
+    }
+    Object.keys(schema)
+        .filter((key) => schema[key]?.type === "DataTable")
+        .forEach((key) => {
+        if (data[key] && !Array.isArray(data[key])) {
+            data[key] = null;
+        }
+    });
+    if (extraKeys?.length) {
+        await Promise.all(extraKeys?.map(async (key) => {
+            const { colModel, table: extraTable, parent_id: parentId, } = schema[key];
+            const colModel1 = Array.isArray(colModel)
+                ? colModel
+                : Object.values(colModel || {});
+            const q1 = `select ${parentId} as parent, ${colModel1
+                .map((col) => col.name || col.key)
+                .join(",")} from ${extraTable} a where ${parentId}=$1`;
+            // console.log(table, formName, q1);
+            const { rows: extraRows } = await pg.query(q1, [id]);
+            Object.assign(data, { [key]: extraRows });
+        }));
+    }
+    if (user?.uid &&
+        !config.security?.disableToken &&
+        actions.includes("edit") &&
+        !called) {
+        data.token = tokenData?.table
+            ? params.table
+            : setToken({
+                ids: [JSON.stringify({ id, table, form })],
+                uid: user.uid,
+                array: 1,
+            })?.[0];
+    }
+    await extraDataGet({ rows: [data], table, form }, pg);
+    const res = await applyHook("afterTable", {
+        pg,
+        table,
+        payload: [data],
+        user,
+    });
+    return res || data || {};
+}

package/dist/server/routes/crud/controllers/update.js

@@ -0,0 +1,113 @@
+import { pgClients, applyHook, getAccess, getTemplate, checkXSS, dataUpdate, logger, getToken, validateData, } from "../../../../utils.js";
+import config from "../../../../config.js";
+import insert from "./insert.js";
+export default async function update(req, reply) {
+    const { pg = pgClients.client, user, params = {}, body = {}, headers = {}, unittest, } = req;
+    if (!user) {
+        return reply.status(403).send("access restricted");
+    }
+    const hookData = (await applyHook("preUpdate", {
+        pg,
+        table: params?.table,
+        id: params?.id,
+        user,
+    }));
+    if (hookData?.message && hookData?.status) {
+        return { message: hookData?.message, status: hookData?.status };
+    }
+    const { referer } = headers;
+    const tokenData = await getToken({
+        uid: user.uid,
+        token: body.token || params.id || params.table,
+        mode: "w",
+        json: 1,
+    });
+    const { form, table: edit, id, } = hookData ||
+        tokenData ||
+        (config.security?.disableToken || config.local || config.auth?.disable
+            ? params
+            : {});
+    const { actions = [] } = (await getAccess({
+        table: edit,
+        form,
+        id,
+        user,
+    }, pg)) || {};
+    if (!tokenData &&
+        !config.local &&
+        !config.security?.disableToken &&
+        !config.auth?.disable) {
+        return reply.status(400).send("invalid token");
+    }
+    if (!actions.includes("edit") && !config.local && !tokenData) {
+        return reply.status(403).send("access restricted: actions");
+    }
+    if (!edit) {
+        return reply.status(400).send("table is required");
+    }
+    if (!id && tokenData?.table) {
+        return insert(req, reply);
+    }
+    if (!id) {
+        return reply.status(400).send("id is required");
+    }
+    const loadTemplate = await getTemplate("table", edit);
+    const { table } = loadTemplate || hookData || tokenData || params || {};
+    const uid = user?.uid;
+    const formData = form || loadTemplate?.form
+        ? await getTemplate("form", form || loadTemplate?.form)
+        : {};
+    const schema = formData?.schema || formData;
+    // skip non-present fields in form schema
+    if (!unittest &&
+        !tokenData?.ignoreCheck &&
+        headers["content-type"] === "application/json") {
+        Object.keys(body || {})
+            .filter((key) => !Object.keys(schema || {}).includes(key))
+            .forEach((key) => delete body[key]);
+    }
+    const xssCheck = checkXSS({ body, schema });
+    if (xssCheck.error && formData?.xssCheck !== false) {
+        logger.file("injection/xss", { msg: xssCheck.error, table }, req);
+        return reply
+            .status(409)
+            .send("Дані містять заборонені символи. Приберіть їх та спробуйте ще раз");
+    }
+    const fieldCheck = validateData({ body, schema });
+    if (fieldCheck.error) {
+        logger.file("injection/sql", {
+            table,
+            form: form || loadTemplate?.form,
+            uid: user?.uid,
+            ...fieldCheck,
+        });
+        return reply
+            .status(409)
+            .send("Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз");
+    }
+    if (tokenData?.obj) {
+        const objData = tokenData.obj?.split("#").reduce((p, el) => ({
+            ...p,
+            [el.split("=")[0] || ""]: el.split("=")[1],
+        }), {}) || {};
+        Object.assign(body, objData);
+    }
+    const res = await dataUpdate({
+        pg,
+        table: loadTemplate?.table || table,
+        id,
+        data: body,
+        uid,
+        tokenData,
+        referer,
+    });
+    // admin.custom_column
+    await applyHook("afterUpdate", {
+        pg,
+        table: params?.table,
+        body,
+        payload: res,
+        user,
+    });
+    return reply.status(200).send(res);
+}

package/dist/server/routes/crud/index.js

@@ -0,0 +1,22 @@
+import update from "./controllers/update.js";
+import insert from "./controllers/insert.js";
+import deleteCrud from "./controllers/deleteCrud.js";
+import table from "./controllers/table.js";
+const tableSchema = {
+    type: "object",
+    properties: {
+        params: {
+            id: { type: "string", pattern: "^([\\w\\d_.]+)$" },
+            table: { type: "string", pattern: "^([\\w\\d_.]+)$" },
+        },
+    },
+};
+const policy = ["public"];
+async function plugin(app, config = { prefix: "/api" }) {
+    const { prefix = "/api" } = config;
+    app.put(`${prefix}/table/:table/:id?`, { config: { policy }, schema: tableSchema }, update);
+    app.delete(`${prefix}/table/:table/:id?`, { config: { policy }, schema: tableSchema }, deleteCrud);
+    app.post(`${prefix}/table/:table/:id?`, { config: { policy }, schema: tableSchema }, insert);
+    app.get(`${prefix}/table/:table/:id?`, { config: { policy }, schema: tableSchema }, table);
+}
+export default plugin;

package/dist/server/routes/dblist/controllers/readItems.js

@@ -0,0 +1,25 @@
+import { config, dblist, getRedis } from "../../../../utils.js";
+import formatData from "../utils/formatData.js";
+const rclient = getRedis();
+export default async function readItemList(req) {
+    const rows = formatData(dblist);
+    const uid = req.session?.passport?.user?.uid || // login db
+        req.session?.passport?.user?.username || // login passwd
+        "2";
+    const key = `current-db:${uid}`;
+    const ttl = config.redis ? await rclient.ttl(key) : null;
+    const currentId = config.redis ? await rclient.get(key) : null;
+    rclient.setex(key, 60 * 60 * 10000, currentId);
+    const { originalMaxAge, expires } = req.session?.cookie || {};
+    return {
+        ttl,
+        current: currentId || rows[0]?.id,
+        rows,
+        user: {
+            ...req.user,
+            originalMaxAge,
+            expires,
+            uid,
+        },
+    };
+}