@opengis/fastify-table 2.1.2 → 2.1.4

package/dist/index.js

@@ -111,8 +111,8 @@ function plugin(fastify) {
     // core migrations (second argument for core only)
     execMigrations(path.join(cwd, "server/migrations"), pgClients.client, true).catch((err) => console.warn(err.toString()));
     // plugins / utils / funcs
-    policyPlugin(fastify);
     authPlugin(fastify); // fastify-auth api + hooks integrated to core
+    policyPlugin(fastify);
     metricPlugin();
     redisPlugin(fastify);
     pgPlugin(fastify);

package/dist/server/helpers/list/descriptionList.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"descriptionList.d.ts","sourceRoot":"","sources":["../../../../server/helpers/list/descriptionList.ts"],"names":[],"mappings":"AAkBA,wBAA8B,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,gBA8BhE"}
+{"version":3,"file":"descriptionList.d.ts","sourceRoot":"","sources":["../../../../server/helpers/list/descriptionList.ts"],"names":[],"mappings":"AAkBA,wBAA8B,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,gBAkChE"}

package/dist/server/helpers/list/descriptionList.js

@@ -33,11 +33,15 @@ export default async function descriptionList(data, opt) {
             continue;
         const key = keys[i + 1];
         const d1 = (await format(data[key], key, data)) || '-';
-        result.push(`<div class="grid grid-cols-1 gap-1 py-3 sm:grid-cols-3 sm:gap-4 even:bg-gray-50 text-[12px]">
-            <dt class="text-gray-900">${nameHBS || name}</dt>
-            <dd class="text-gray-700 sm:col-span-2">${d1}</dd>
-            </div>
-        `);
+        result.push(`<div class="flex flex-wrap sm:grid sm:grid-cols-3 gap-1 py-3 even:bg-gray-50 text-[12px]">
+            <dt class="text-gray-900 w-full sm:w-auto sm:col-span-1 pr-2 break-words">
+                ${nameHBS || name}
+            </dt>
+            
+            <dd class="text-gray-700 sm:col-span-2 w-full sm:w-auto break-words whitespace-normal">
+                ${d1}
+            </dd>
+        </div>`);
     }
     return `<dl class=" divide-y divide-gray-100 py-[5px] w-full">${result.join('')}</dl>`;
 }

package/dist/server/plugins/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/plugins/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAYxD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAMtD,wBAAsB,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,iBA8HxE;AAED,iBAAS,MAAM,CAAC,OAAO,EAAE,eAAe,QAgCvC;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/plugins/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAYxD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAMtD,wBAAsB,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,iBA+HxE;AAED,iBAAS,MAAM,CAAC,OAAO,EAAE,eAAe,QAmCvC;AAED,eAAe,MAAM,CAAC"}

package/dist/server/plugins/auth/index.js

@@ -21,11 +21,12 @@ export async function onRequest(req, reply) {
         req.ip === "127.0.0.1" ||
         req.ip?.startsWith?.("192.168.") ||
         config.debug) &&
-        req.headers?.token &&
-        config.auth?.tokens?.includes?.(headers.token);
+        ((req.headers?.token && config.auth?.tokens?.includes?.(headers.token)) ||
+            process.env.NODE_ENV === "test" ||
+            process.env.VITEST);
     if (validToken && !req?.user?.uid) {
         req.user = {
-            uid: req.headers?.uid?.toString?.(),
+            uid: req.headers?.uid?.toString?.() || "1",
             user_type: req.headers?.user_type?.toString?.() || "regular",
         };
     }
@@ -112,6 +113,10 @@ function plugin(fastify) {
     if (!config.redis) {
         return;
     }
+    fastify.addHook("onRequest", onRequest);
+    if (process.env.NODE_ENV === "test" || process.env.VITEST) {
+        return;
+    }
     fastify.register(cookie, {
         parseOptions: config?.auth?.cookieOptions || { secure: false },
     });
@@ -131,6 +136,5 @@ function plugin(fastify) {
     fastifyPassport.registerUserSerializer(async (user) => ({ user }));
     // deserialize user used to add user info from session store to req
     fastifyPassport.registerUserDeserializer(async (passport) => passport?.user || passport);
-    fastify.addHook("onRequest", onRequest);
 }
 export default plugin;

package/dist/server/plugins/auth/onRequest.d.ts

@@ -0,0 +1,4 @@
+import { FastifyReply } from "fastify";
+import { ExtendedRequest } from "../../types/core.js";
+export default function onRequest(req: ExtendedRequest, reply: FastifyReply): Promise<null>;
+//# sourceMappingURL=onRequest.d.ts.map

package/dist/server/plugins/auth/onRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onRequest.d.ts","sourceRoot":"","sources":["../../../../server/plugins/auth/onRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAMvC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAItD,wBAA8B,SAAS,CACrC,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,YAAY,iBA+HpB"}

package/dist/server/plugins/auth/onRequest.js

@@ -0,0 +1,104 @@
+import { existsSync } from "node:fs";
+import config from "../../../config.js";
+const { prefix = "/api" } = config;
+export default async function onRequest(req, reply) {
+    const { hostname, headers, routeOptions } = req;
+    const { config: routeConfig, method, handler, url } = routeOptions || {};
+    const { policy } = routeConfig || {};
+    const isApi = method && url && typeof handler === "function" && url !== "*";
+    // handle non-api at vite/vike
+    if (!isApi) {
+        return null;
+    }
+    // proxy from old apps to editor, bi etc.
+    const validToken = (req.ip === "193.239.152.181" ||
+        req.ip === "127.0.0.1" ||
+        req.ip?.startsWith?.("192.168.") ||
+        config.debug) &&
+        req.headers?.token &&
+        config.auth?.tokens?.includes?.(headers.token);
+    if (validToken && !req?.user?.uid) {
+        req.user = {
+            uid: req.headers?.uid?.toString?.(),
+            user_type: req.headers?.user_type?.toString?.() || "regular",
+        };
+    }
+    const isAdmin = process.env.NODE_ENV === "admin" ||
+        hostname?.split?.(":")?.shift?.() === config.adminDomain ||
+        config.admin ||
+        hostname?.startsWith?.("admin");
+    const isPublic = Array.isArray(policy)
+        ? policy.includes("public")
+        : policy === "L0";
+    if (req.cookies?.["session_auth"] &&
+        !req.session?.passport?.user?.uid &&
+        (config.auth?.disable || config.auth?.user)) {
+        req.session = req.session || {};
+        req.session.passport = req.session.passport || {}; // ensure passport session exists
+        req.session.passport.user = {
+            ...(config.auth?.user || {}),
+            uid: config.auth?.user?.uid?.toString?.() || "1",
+            user_rnokpp: config.auth?.user?.rnokpp,
+            user_type: config.auth?.user?.type || "regular",
+        };
+        req.user = req.session.passport.user;
+    }
+    // ! intentional: null || undefined > undefined
+    req.user = req.user || req.session?.passport?.user || undefined; // fix for user.uid errors, by default user is null, while with express passport it was {}, unauthorized user does not trigger serializer
+    // currently 2factor + auth with passwd file not supported
+    const ispasswd = (existsSync("passwd") && !config.auth?.["2factor"]) || config.auth?.passwd;
+    const loginPageUrl = config.auth?.link?.core?.login || config?.auth?.redirect || "/login";
+    if (!req.user?.uid &&
+        !config.auth?.disable &&
+        isAdmin &&
+        !isPublic &&
+        !config.auth?.disableRedirect &&
+        !req.url.startsWith(prefix) &&
+        !req.url.startsWith("/api") &&
+        !req.url.includes(loginPageUrl) &&
+        !req.url.includes(".") &&
+        !req.url.includes("@")) {
+        if (isApi) {
+            return reply.status(401).send({ error: "unauthorized", code: 401 });
+        }
+        return reply.redirect(`${loginPageUrl}` + `?redirect=${req.url}`);
+    }
+    // by default, disable 2factor for id.gov.ua auth
+    const check = req.user?.auth_type === "govid" ? config.auth?.["2factor"]?.govid : true;
+    const login2faPage = config.auth?.link?.["2fa"]?.login || "/2factor";
+    // example: 2factor for admin env only, while public env does not require it
+    const checkEnv = () => {
+        if (!config.auth?.["2factorEnv"])
+            return true;
+        if ((config.auth?.["2factorEnv"] &&
+            process.env.NODE_ENV === config.auth?.["2factorEnv"]) ||
+            (config.auth?.["2factorEnv"] === "admin" && isAdmin)) {
+            return true;
+        }
+        return false;
+    };
+    // if 2factor is enabled globally + for user and secondFactorPassed not true => redirect to 2factor login page
+    if (req.user?.uid &&
+        req.user?.twofa &&
+        // config.auth?.["2factor"] &&
+        // !isPublic &&
+        (routeOptions?.method || "GET") === "GET" &&
+        !req.session?.secondFactorPassed &&
+        !ispasswd &&
+        !config.auth?.disableRedirect &&
+        !config.auth?.disable &&
+        check &&
+        checkEnv() &&
+        !req.url.startsWith(login2faPage) &&
+        !routeOptions.url?.includes?.("/logout") &&
+        !routeOptions.url?.includes?.("/2fa") &&
+        !routeOptions.url?.includes?.("/assets")) {
+        if (isApi) {
+            return reply
+                .status(403)
+                .send({ error: "access restricted: twofa", code: 403 });
+        }
+        return reply.redirect(login2faPage);
+    }
+    return null;
+}

package/dist/server/plugins/crud/funcs/dataInsert.d.ts

@@ -1,5 +1,5 @@
 import type { ExtendedPG } from "../../../types/core.js";
-export default function dataInsert({ id, table: table1, referer, data, pg: pg1, uid, tokenData, }: {
+export default function dataInsert({ id, table: table1, referer, data, pg: pg1, uid, tokenData, log, }: {
     id?: string | number;
     table: string;
     referer?: string;
@@ -7,5 +7,6 @@ export default function dataInsert({ id, table: table1, referer, data, pg: pg1,
     pg?: ExtendedPG;
     uid?: string;
     tokenData?: Record<string, any>;
+    log?: Boolean;
 }): Promise<any>;
 //# sourceMappingURL=dataInsert.d.ts.map

package/dist/server/plugins/crud/funcs/dataInsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dataInsert.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/crud/funcs/dataInsert.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAgBzD,wBAA8B,UAAU,CAAC,EACvC,EAAE,EACF,KAAK,EAAE,MAAM,EACb,OAAO,EACP,IAAI,EACJ,EAAE,EAAE,GAAG,EACP,GAAG,EACH,SAAc,GACf,EAAE;IACD,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACjC,gBAoKA"}
+{"version":3,"file":"dataInsert.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/crud/funcs/dataInsert.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAgBzD,wBAA8B,UAAU,CAAC,EACvC,EAAE,EACF,KAAK,EAAE,MAAM,EACb,OAAO,EACP,IAAI,EACJ,EAAE,EAAE,GAAG,EACP,GAAG,EACH,SAAc,EACd,GAAU,GACX,EAAE;IACD,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,gBAsKA"}

package/dist/server/plugins/crud/funcs/dataInsert.js

@@ -9,7 +9,7 @@ import logger from "../../logger/getLogger.js";
 import extraData from "../../extra/extraData.js";
 import getMeta from "../../pg/funcs/getMeta.js";
 const rclient = getRedis();
-export default async function dataInsert({ id, table: table1, referer, data, pg: pg1, uid, tokenData = {}, }) {
+export default async function dataInsert({ id, table: table1, referer, data, pg: pg1, uid, tokenData = {}, log = true, }) {
     const pg = pg1 || getPG({ name: "client" });
     if (!pg) {
         return null;
@@ -95,16 +95,18 @@ export default async function dataInsert({ id, table: table1, referer, data, pg:
                 Object.assign(res.rows[0], { [key]: parentRows.filter(Boolean) });
             }));
         }
-        await logChanges({
-            pg: client,
-            table,
-            tokenData,
-            referer,
-            data,
-            id: id1,
-            uid,
-            type: "INSERT",
-        });
+        if (log) {
+            await logChanges({
+                pg: client,
+                table,
+                tokenData,
+                referer,
+                data,
+                id: id1,
+                uid,
+                type: "INSERT",
+            });
+        }
         if (config.redis && rclient?.status !== "end") {
             rclient.incr(`pg:${client.options?.database}:${table}:crud`);
         }

package/dist/server/plugins/crud/funcs/dataUpdate.d.ts

@@ -1,5 +1,5 @@
 import { ExtendedPG } from "../../../types/core.js";
-export default function dataUpdate({ table: table1, tokenData, referer, id, data, pg: pg1, uid, }: {
+export default function dataUpdate({ table: table1, tokenData, referer, id, data, pg: pg1, uid, log, }: {
     table: string;
     tokenData?: Record<string, any>;
     referer?: string;
@@ -7,5 +7,6 @@ export default function dataUpdate({ table: table1, tokenData, referer, id, data
     data: Record<string, any>;
     pg?: ExtendedPG;
     uid?: string;
+    log?: Boolean;
 }): Promise<any>;
 //# sourceMappingURL=dataUpdate.d.ts.map

package/dist/server/plugins/crud/funcs/dataUpdate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dataUpdate.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/crud/funcs/dataUpdate.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAepD,wBAA8B,UAAU,CAAC,EACvC,KAAK,EAAE,MAAM,EACb,SAAS,EACT,OAAO,EACP,EAAE,EACF,IAAI,EACJ,EAAE,EAAE,GAAG,EACP,GAAG,GACJ,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,gBAsPA"}
+{"version":3,"file":"dataUpdate.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/crud/funcs/dataUpdate.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAepD,wBAA8B,UAAU,CAAC,EACvC,KAAK,EAAE,MAAM,EACb,SAAS,EACT,OAAO,EACP,EAAE,EACF,IAAI,EACJ,EAAE,EAAE,GAAG,EACP,GAAG,EACH,GAAU,GACX,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,gBAwPA"}

package/dist/server/plugins/crud/funcs/dataUpdate.js

@@ -19,7 +19,7 @@ function assignValue(key, i, srid = 4326, columnType = "text") {
     }
     return `"${key}"=$${i + 2}`;
 }
-export default async function dataUpdate({ table: table1, tokenData, referer, id, data, pg: pg1, uid, }) {
+export default async function dataUpdate({ table: table1, tokenData, referer, id, data, pg: pg1, uid, log = true, }) {
     if (!data || !table1 || !id) {
         return null;
     }
@@ -161,16 +161,18 @@ export default async function dataUpdate({ table: table1, tokenData, referer, id
                 }
             }));
         }
-        await logChanges({
-            pg,
-            table,
-            tokenData,
-            referer,
-            data,
-            id,
-            uid,
-            type: "UPDATE",
-        });
+        if (log) {
+            await logChanges({
+                pg: client,
+                table,
+                tokenData,
+                referer,
+                data,
+                id,
+                uid,
+                type: "UPDATE",
+            });
+        }
         if (config.redis && rclient?.status !== "end") {
             rclient.incr(`pg:${client.options?.database}:${table}:crud`);
         }

package/dist/server/plugins/policy/funcs/checkAuth.d.ts

@@ -0,0 +1,4 @@
+import { FastifyReply } from "fastify";
+import { ExtendedRequest } from "../../../types/core.js";
+export default function onRequest(req: ExtendedRequest, reply: FastifyReply): Promise<null>;
+//# sourceMappingURL=checkAuth.d.ts.map

package/dist/server/plugins/policy/funcs/checkAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkAuth.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAMvC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIzD,wBAA8B,SAAS,CACrC,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,YAAY,iBA+HpB"}

package/dist/server/plugins/policy/funcs/checkAuth.js

@@ -0,0 +1,104 @@
+import { existsSync } from "node:fs";
+import config from "../../../../config.js";
+const { prefix = "/api" } = config;
+export default async function onRequest(req, reply) {
+    const { hostname, headers, routeOptions } = req;
+    const { config: routeConfig, method, handler, url } = routeOptions || {};
+    const { policy } = routeConfig || {};
+    const isApi = method && url && typeof handler === "function" && url !== "*";
+    // handle non-api at vite/vike
+    if (!isApi) {
+        return null;
+    }
+    // proxy from old apps to editor, bi etc.
+    const validToken = (req.ip === "193.239.152.181" ||
+        req.ip === "127.0.0.1" ||
+        req.ip?.startsWith?.("192.168.") ||
+        config.debug) &&
+        req.headers?.token &&
+        config.auth?.tokens?.includes?.(headers.token);
+    if (validToken && !req?.user?.uid) {
+        req.user = {
+            uid: req.headers?.uid?.toString?.(),
+            user_type: req.headers?.user_type?.toString?.() || "regular",
+        };
+    }
+    const isAdmin = process.env.NODE_ENV === "admin" ||
+        hostname?.split?.(":")?.shift?.() === config.adminDomain ||
+        config.admin ||
+        hostname?.startsWith?.("admin");
+    const isPublic = Array.isArray(policy)
+        ? policy.includes("public")
+        : policy === "L0";
+    if (req.cookies?.["session_auth"] &&
+        !req.session?.passport?.user?.uid &&
+        (config.auth?.disable || config.auth?.user)) {
+        req.session = req.session || {};
+        req.session.passport = req.session.passport || {}; // ensure passport session exists
+        req.session.passport.user = {
+            ...(config.auth?.user || {}),
+            uid: config.auth?.user?.uid?.toString?.() || "1",
+            user_rnokpp: config.auth?.user?.rnokpp,
+            user_type: config.auth?.user?.type || "regular",
+        };
+        req.user = req.session.passport.user;
+    }
+    // ! intentional: null || undefined > undefined
+    req.user = req.user || req.session?.passport?.user || undefined; // fix for user.uid errors, by default user is null, while with express passport it was {}, unauthorized user does not trigger serializer
+    // currently 2factor + auth with passwd file not supported
+    const ispasswd = (existsSync("passwd") && !config.auth?.["2factor"]) || config.auth?.passwd;
+    const loginPageUrl = config.auth?.link?.core?.login || config?.auth?.redirect || "/login";
+    if (!req.user?.uid &&
+        !config.auth?.disable &&
+        isAdmin &&
+        !isPublic &&
+        !config.auth?.disableRedirect &&
+        !req.url.startsWith(prefix) &&
+        !req.url.startsWith("/api") &&
+        !req.url.includes(loginPageUrl) &&
+        !req.url.includes(".") &&
+        !req.url.includes("@")) {
+        if (isApi) {
+            return reply.status(401).send({ error: "unauthorized", code: 401 });
+        }
+        return reply.redirect(`${loginPageUrl}` + `?redirect=${req.url}`);
+    }
+    // by default, disable 2factor for id.gov.ua auth
+    const check = req.user?.auth_type === "govid" ? config.auth?.["2factor"]?.govid : true;
+    const login2faPage = config.auth?.link?.["2fa"]?.login || "/2factor";
+    // example: 2factor for admin env only, while public env does not require it
+    const checkEnv = () => {
+        if (!config.auth?.["2factorEnv"])
+            return true;
+        if ((config.auth?.["2factorEnv"] &&
+            process.env.NODE_ENV === config.auth?.["2factorEnv"]) ||
+            (config.auth?.["2factorEnv"] === "admin" && isAdmin)) {
+            return true;
+        }
+        return false;
+    };
+    // if 2factor is enabled globally + for user and secondFactorPassed not true => redirect to 2factor login page
+    if (req.user?.uid &&
+        req.user?.twofa &&
+        // config.auth?.["2factor"] &&
+        // !isPublic &&
+        (routeOptions?.method || "GET") === "GET" &&
+        !req.session?.secondFactorPassed &&
+        !ispasswd &&
+        !config.auth?.disableRedirect &&
+        !config.auth?.disable &&
+        check &&
+        checkEnv() &&
+        !req.url.startsWith(login2faPage) &&
+        !routeOptions.url?.includes?.("/logout") &&
+        !routeOptions.url?.includes?.("/2fa") &&
+        !routeOptions.url?.includes?.("/assets")) {
+        if (isApi) {
+            return reply
+                .status(403)
+                .send({ error: "access restricted: twofa", code: 403 });
+        }
+        return reply.redirect(login2faPage);
+    }
+    return null;
+}

package/dist/server/plugins/policy/funcs/checkPermissions.d.ts

@@ -1,4 +1,6 @@
-import type { FastifyReply } from "fastify";
 import type { ExtendedRequest } from "../../../types/core.js";
-export default function checkPermissions(req: ExtendedRequest, reply: FastifyReply): Promise<null>;
+export default function checkPermissions(req: ExtendedRequest): Promise<{
+    error: string;
+    code: number;
+} | null>;
 //# sourceMappingURL=checkPermissions.d.ts.map

package/dist/server/plugins/policy/funcs/checkPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkPermissions.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAMhC,wBAA8B,gBAAgB,CAC5C,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,YAAY,iBAkEpB"}
+{"version":3,"file":"checkPermissions.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAMhC,wBAA8B,gBAAgB,CAAC,GAAG,EAAE,eAAe;;;UA+DlE"}

package/dist/server/plugins/policy/funcs/checkPermissions.js

@@ -1,7 +1,7 @@
 import logger from "../../logger/getLogger.js";
 import getUserPermissions from "../../access/funcs/getUserPermissions.js";
 import pgClients from "../../pg/pgClients.js";
-export default async function checkPermissions(req, reply) {
+export default async function checkPermissions(req) {
     const { originalUrl: path, query, params, method, routeOptions, pg = pgClients.client, } = req;
     const user = req.user || req.session?.passport?.user;
     const body = req.body
@@ -31,9 +31,7 @@ export default async function checkPermissions(req, reply) {
             message: "access restricted: permissions",
             uid: user?.uid,
         });
-        return reply
-            .status(403)
-            .send({ error: "access restricted: permissions", code: 403 });
+        return { error: "access restricted: permissions", code: 403 };
     }
     return null;
 }

package/dist/server/plugins/policy/funcs/checkPolicy.d.ts

@@ -1,4 +1,6 @@
-import type { FastifyReply } from "fastify";
 import type { ExtendedRequest } from "../../../types/core.js";
-export default function checkPolicy(req: ExtendedRequest, reply: FastifyReply): FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown> | null;
+export default function checkPolicy(req: ExtendedRequest): {
+    error: string;
+    code: number;
+} | null;
 //# sourceMappingURL=checkPolicy.d.ts.map

package/dist/server/plugins/policy/funcs/checkPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkPolicy.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,oSAoK5E"}
+{"version":3,"file":"checkPolicy.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,GAAG,EAAE,eAAe;;;SAoKvD"}

package/dist/server/plugins/policy/funcs/checkPolicy.js

@@ -1,6 +1,6 @@
 import { config, logger } from "../../../../utils.js";
 import block from "../sqlInjection.js";
-export default function checkPolicy(req, reply) {
+export default function checkPolicy(req) {
     const { originalUrl: path, hostname, query, params, headers, method, routeOptions, } = req;
     const user = req.user || req.session?.passport?.user;
     const body = req.body
@@ -31,7 +31,7 @@ export default function checkPolicy(req, reply) {
             method,
             userRole: user.user_type,
         });
-        return reply.status(403).send({ error: "access restricted: 0", code: 403 });
+        return { error: "access restricted: 0", code: 403 };
     }
     // ! role
     if (isRole) {
@@ -45,7 +45,7 @@ export default function checkPolicy(req, reply) {
             body,
             uid: user?.uid,
         });
-        return reply.status(403).send({ error: "access restricted: 0", code: 403 });
+        return { error: "access restricted: 0", code: 403 };
     }
     // ! file injection
     if (JSON.stringify(params || {})?.includes("../") ||
@@ -59,7 +59,7 @@ export default function checkPolicy(req, reply) {
             body,
             uid: user?.uid,
         });
-        return reply.status(409).send({ error: "access restricted: 1", code: 409 });
+        return { error: "access restricted: 1", code: 409 };
     }
     // ! invalid file extension
     if (path.includes("files/") && allowExtPublic.includes(ext)) {
@@ -77,7 +77,7 @@ export default function checkPolicy(req, reply) {
             stopWords,
             uid: user?.uid,
         });
-        return reply.status(409).send({ error: "access restricted: 2", code: 409 });
+        return { error: "access restricted: 2", code: 409 };
     }
     // ! user required, but not logged in
     if (requireUser && !user) {
@@ -88,7 +88,7 @@ export default function checkPolicy(req, reply) {
             query,
             body,
         });
-        return reply.status(401).send({ error: "access restricted: 3", code: 401 });
+        return { error: "access restricted: 3", code: 401 };
     }
     // ! referer
     if (requireReferer && !headers?.referer?.includes?.(hostname)) {
@@ -100,7 +100,7 @@ export default function checkPolicy(req, reply) {
             body,
             uid: user?.uid,
         });
-        return reply.status(403).send({ error: "access restricted: 4", code: 403 });
+        return { error: "access restricted: 4", code: 403 };
     }
     // ! public / token
     if (isPublic || config.debug) {
@@ -120,7 +120,7 @@ export default function checkPolicy(req, reply) {
             message: "access restricted: 6",
             uid: user?.uid,
         });
-        return reply.status(403).send({ error: "access restricted: 6", code: 403 });
+        return { error: "access restricted: 6", code: 403 };
     }
     return null;
 }

package/dist/server/plugins/policy/index.d.ts

@@ -1,3 +1,3 @@
-declare function plugin(fastify: any): Promise<void>;
+declare function plugin(fastify: any): void;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/server/plugins/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/plugins/policy/index.ts"],"names":[],"mappings":"AAKA,iBAAe,MAAM,CAAC,OAAO,EAAE,GAAG,iBAkCjC;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/plugins/policy/index.ts"],"names":[],"mappings":"AAKA,iBAAS,MAAM,CAAC,OAAO,EAAE,GAAG,QAiC3B;AAED,eAAe,MAAM,CAAC"}

package/dist/server/plugins/policy/index.js

@@ -1,8 +1,8 @@
 import config from "../../../config.js";
 import checkPolicy from "./funcs/checkPolicy.js";
 import checkPermissions from "./funcs/checkPermissions.js";
-async function plugin(fastify) {
-    fastify.addHook("preParsing", async (request, reply) => {
+function plugin(fastify) {
+    fastify.addHook("preHandler", async (request, reply) => {
         // ! skip locally, skip tests
         if ((process.env.local === "true" || process.env.NODE_ENV === "test") &&
             !config.debugAuth &&
@@ -18,13 +18,13 @@ async function plugin(fastify) {
         if (!isApi) {
             return null;
         }
-        const resp1 = await checkPermissions(request, reply);
+        const resp1 = await checkPermissions(request);
         if (resp1) {
-            return resp1;
+            return reply.status(resp1.code || 403).send(resp1);
         }
-        const resp = checkPolicy(request, reply);
+        const resp = checkPolicy(request);
         if (resp) {
-            return resp;
+            return reply.status(resp.code || 403).send(resp);
         }
         return null;
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "type": "module",
   "description": "core-plugins",
   "keywords": [