@opengis/fastify-table 2.5.18 → 2.5.21

package/dist/server/plugins/auth/funcs/getQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getQuery.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/auth/funcs/getQuery.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,wBAA8B,QAAQ,CAAC,EACrC,EAAE,EACF,IAAI,GACL,EAAE;IACD,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC3B,gBAkIA"}
+{"version":3,"file":"getQuery.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/auth/funcs/getQuery.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,wBAA8B,QAAQ,CAAC,EACrC,EAAE,EACF,IAAI,GACL,EAAE;IACD,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC3B,gBAoIA"}

package/dist/server/plugins/auth/funcs/getQuery.js

@@ -124,5 +124,5 @@ export default async function getQuery({ pg, data, }) {
         .query(`select * from admin.users where uid =(select uid from admin.users_social_auth 
   where ${id ? "social_auth_id=$1" : "email=$1"} limit 1)`, [id || email])
         .then((el) => el.rows?.[0] || {});
-    return result;
+    return { ...result, isNewUser: !(userId || socialUserId) };
 }

package/dist/server/plugins/crud/funcs/dataUpdate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dataUpdate.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/crud/funcs/dataUpdate.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAepD,wBAA8B,UAAU,CAAC,EACvC,KAAK,EAAE,MAAM,EACb,SAAS,EACT,OAAO,EACP,EAAE,EACF,IAAI,EACJ,EAAE,EAAE,GAAG,EACP,GAAG,EACH,GAAU,GACX,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,gBAwPA"}
+{"version":3,"file":"dataUpdate.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/crud/funcs/dataUpdate.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAiBpD,wBAA8B,UAAU,CAAC,EACvC,KAAK,EAAE,MAAM,EACb,SAAS,EACT,OAAO,EACP,EAAE,EACF,IAAI,EACJ,EAAE,EAAE,GAAG,EACP,GAAG,EACH,GAAU,GACX,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,gBAwPA"}

package/dist/server/plugins/crud/funcs/dataUpdate.js

@@ -8,6 +8,7 @@ import extraData from "../../extra/extraData.js";
 import logChanges from "./utils/logChanges.js";
 import logger from "../../logger/getLogger.js";
 import getInsertQuery from "./utils/getInsertQuery.js";
+import nullif from "./utils/nullif.js";
 const rclient = getRedis();
 const srids = {};
 function assignValue(key, i, srid = 4326, columnType = "text") {
@@ -64,7 +65,7 @@ export default async function dataUpdate({ table: table1, tokenData, referer, id
             ["string", "number"].includes(typeof data[el])) {
             Object.assign(data, { [el]: data[el].split(",") });
         }
-        return [el, data[el] === "" ? null : data[el]]; // ensure '' on number does not throw
+        return [el, nullif(data[el])]; // ensure '' on number does not throw
     })
         .map((el) => typeof el[1] === "object" && types[el[0]]?.includes?.("json") && el[1]
         ? JSON.stringify(el[1])

package/dist/server/plugins/crud/funcs/utils/getInsertQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getInsertQuery.d.ts","sourceRoot":"","sources":["../../../../../../server/plugins/crud/funcs/utils/getInsertQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAI5D,wBAA8B,cAAc,CAAC,EAC3C,EAAE,EACF,KAAK,EACL,IAAI,EACJ,EAAE,EACF,GAAG,GACJ,EAAE;IACD,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3B,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;;;;;UA+EA"}
+{"version":3,"file":"getInsertQuery.d.ts","sourceRoot":"","sources":["../../../../../../server/plugins/crud/funcs/utils/getInsertQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAM5D,wBAA8B,cAAc,CAAC,EAC3C,EAAE,EACF,KAAK,EACL,IAAI,EACJ,EAAE,EACF,GAAG,GACJ,EAAE;IACD,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3B,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;;;;;UA+EA"}

package/dist/server/plugins/crud/funcs/utils/getInsertQuery.js

@@ -1,4 +1,5 @@
 import getMeta from "../../../pg/funcs/getMeta.js";
+import nullif from "./nullif.js";
 export default async function getInsertQuery({ pg, table, data, id, uid, }) {
     if (!pg?.pk || !data) {
         return null;
@@ -54,7 +55,7 @@ export default async function getInsertQuery({ pg, table, data, id, uid, }) {
                 typeof el[1]?.[0] === "object" ||
                 types[el[0]] === "json")
             ? JSON.stringify(el[1])
-            : el[1]),
+            : nullif(el[1])),
     ];
     const keys = filterData.map((el) => el[0]);
     return { insertQuery, args, keys, systemColumns };

package/dist/server/plugins/crud/funcs/utils/nullif.d.ts

@@ -0,0 +1,3 @@
+declare const nullif: (val: any) => any;
+export default nullif;
+//# sourceMappingURL=nullif.d.ts.map

package/dist/server/plugins/crud/funcs/utils/nullif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nullif.d.ts","sourceRoot":"","sources":["../../../../../../server/plugins/crud/funcs/utils/nullif.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,MAAM,GAAI,KAAK,GAAG,QAQvB,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/server/plugins/crud/funcs/utils/nullif.js

@@ -0,0 +1,10 @@
+const nullif = (val) => {
+    if (Array.isArray(val) && val.length === 0) {
+        return null;
+    }
+    if (typeof val === "string" && val === "") {
+        return null;
+    }
+    return val;
+};
+export default nullif;

package/dist/server/plugins/file/uploadMultiPart.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploadMultiPart.d.ts","sourceRoot":"","sources":["../../../../server/plugins/file/uploadMultiPart.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,KAAK;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA2CD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,mBAkBvE;AAED,wBAAsB,gBAAgB,CACpC,EACE,IAAI,EAAE,QAAQ,EACd,MAA2C,EAC3C,MAAM,GACP,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACpD,MAAM,MAAW,mBA+BlB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,GAAG,EACR,EACE,UAAU,EACV,GAAG,EACH,MAAM,EACN,gBAAwB,GACzB,GAAE;IACD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACvB,GACL,OAAO,CAAC,KAAK,CAAC,CAmHhB;AAED,eAAe,eAAe,CAAC"}
+{"version":3,"file":"uploadMultiPart.d.ts","sourceRoot":"","sources":["../../../../server/plugins/file/uploadMultiPart.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,KAAK;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA2CD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,mBAkBvE;AAED,wBAAsB,gBAAgB,CACpC,EACE,IAAI,EAAE,QAAQ,EACd,MAA2C,EAC3C,MAAM,GACP,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACpD,MAAM,MAAW,mBA+BlB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,GAAG,EACR,EACE,UAAU,EACV,GAAG,EACH,MAAM,EACN,gBAAwB,GACzB,GAAE;IACD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACvB,GACL,OAAO,CAAC,KAAK,CAAC,CAwHhB;AAED,eAAe,eAAe,CAAC"}

package/dist/server/plugins/file/uploadMultiPart.js

@@ -90,6 +90,10 @@ export async function uploadMultiPart(req, { extensions, raw, subdir, originalFi
     if (extensions && !extensions.includes(ext)) {
         throw new BadRequestError("file extension is not allowed");
     }
+    const dir = subdir != null ? subdir : req.params?.["*"] || "uploads";
+    if (dir.replace(/%2e/g, ".").replace(/%2E/g, ".").includes("..")) {
+        throw new ConflictError("path traversal is not allowed");
+    }
     // ! check extension by core list if custom not provided - from filename
     if (!extensions && !allowedExtensions.includes(ext.substring(1))) {
         throw new BadRequestError("file extension is not allowed");
@@ -119,7 +123,6 @@ export async function uploadMultiPart(req, { extensions, raw, subdir, originalFi
     if (fileExtension !== nameExt) {
         throw new ConflictError("file type spoofing attempt detected");
     }
-    const dir = subdir != null ? subdir : req.params?.["*"] || "uploads";
     const yearMonthDay = subdir != null ? "" : new Date().toISOString().split("T")[0];
     const dbname = req.pg?.options?.database || req.pg?.database || config.pg?.database; // request / config params / default config params
     const rootDir = config.root || `/data/local/${dbname || ""}`;

package/dist/server/plugins/policy/funcs/checkPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkPolicy.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,GAAG,QAmJlE"}
+{"version":3,"file":"checkPolicy.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,GAAG,QAkIlE"}

package/dist/server/plugins/policy/funcs/checkPolicy.js

@@ -1,5 +1,5 @@
 import { config, logger } from "../../../../utils.js";
-import { ConflictError, ForbiddenError } from "../../../../errors.js";
+import { ForbiddenError } from "../../../../errors.js";
 export default function checkPolicy(req, jwt) {
     const { originalUrl: path, hostname, query, params, headers, method, routeOptions, } = req;
     const user = req.user || req.session?.passport?.user;
@@ -12,7 +12,7 @@ export default function checkPolicy(req, jwt) {
         hostname.startsWith("admin");
     const { role, referer, policy = [], } = (routeOptions?.config || {});
     // role=admin|regular
-    const isRole = (role && (!user?.user_type || !role?.includes?.(user?.user_type))) ||
+    const isRole = (role && (!user?.user_type || !user?.user_type?.includes?.(role))) ||
         (policy.includes("admin") && !user?.user_type?.includes?.("admin"));
     const allowExtPublic = [".png", ".jpg", ".svg"];
     const ext = path.toLowerCase().substr(-4);
@@ -47,20 +47,6 @@ export default function checkPolicy(req, jwt) {
         });
         throw ForbiddenError("access restricted: 0");
     }
-    // ! file injection
-    if (JSON.stringify(params || {})?.includes("../") ||
-        JSON.stringify(query || {})?.includes("../") ||
-        path?.includes("../")) {
-        logger.file("injection/file", {
-            path,
-            method,
-            params,
-            query,
-            body,
-            uid: user?.uid,
-        });
-        throw ConflictError("access restricted: 1");
-    }
     // ! invalid file extension
     if (path.includes("files/") && allowExtPublic.includes(ext)) {
         return null;

package/dist/server/plugins/policy/funcs/checkTraversal.d.ts

@@ -0,0 +1,2 @@
+export default function checkTraversal(request: any): void;
+//# sourceMappingURL=checkTraversal.d.ts.map

package/dist/server/plugins/policy/funcs/checkTraversal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkTraversal.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkTraversal.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,OAAO,EAAE,GAAG,QAgBlD"}

package/dist/server/plugins/policy/funcs/checkTraversal.js

@@ -0,0 +1,22 @@
+import { logger } from "../../../../utils.js";
+import { ConflictError } from "../../../../errors.js";
+const decodeTraversal = (str) => str
+    .replace(/%2e/g, ".")
+    .replace(/%2E/g, ".")
+    .replace(/%2f/g, "/")
+    .replace(/%2F/g, "/");
+export default function checkTraversal(request) {
+    const { method, originalUrl, query, params, user } = request;
+    if (decodeTraversal(JSON.stringify(params || {})).includes("../") ||
+        decodeTraversal(JSON.stringify(query || {})).includes("../") ||
+        decodeTraversal(originalUrl).includes("../")) {
+        logger.file("injection/file", {
+            path: originalUrl,
+            method,
+            params,
+            query,
+            uid: user?.uid,
+        });
+        throw ConflictError("path traversal detected");
+    }
+}

package/dist/server/plugins/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/plugins/policy/index.ts"],"names":[],"mappings":"AAMA,iBAAS,MAAM,CAAC,OAAO,EAAE,GAAG,QA6B3B;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/plugins/policy/index.ts"],"names":[],"mappings":"AAOA,iBAAS,MAAM,CAAC,OAAO,EAAE,GAAG,QA+B3B;AAED,eAAe,MAAM,CAAC"}

package/dist/server/plugins/policy/index.js

@@ -1,9 +1,11 @@
 import config from "../../../config.js";
 import checkPolicy from "./funcs/checkPolicy.js";
+import checkTraversal from "./funcs/checkTraversal.js";
 import checkPermissions from "./funcs/checkPermissions.js";
 import checkJWT from "./funcs/checkJWT.js";
 function plugin(fastify) {
-    fastify.addHook("preHandler", async (request, reply) => {
+    fastify.addHook("preHandler", async (request) => {
+        checkTraversal(request);
         // ! skip locally, skip tests
         if ((process.env.local === "true" || process.env.NODE_ENV === "test") &&
             !config.debugAuth &&

package/dist/server/plugins/table/funcs/getSelect.js

@@ -12,10 +12,10 @@ export default async function getSelect(name, pg = pgClients.client, nocache = f
         return loadCls[name];
     }
     const clsDataGIT = await getTemplate(["cls", "select"], name);
-    const { type } = pg.pk?.["admin.user_cls"] && false
+    const { type } = pg.pk?.["admin.user_cls"]
         ? await pg
-            .query("select type from admin.user_cls where parent is null and name=$1 union all select type from admin.cls where parent is null and name=$1 limit 1", [name])
-            .then((el) => el.rows?.[0] || {})
+            .query("select type from admin.user_cls where parent is null and name=$1 and type<>'sql' union all select type from admin.cls where parent is null and name=$1 and type<>'sql' limit 1", [name])
+            .then((r) => r.rows?.[0] || {})
         : {};
     const clsDataDB = sqls[type || ""]
         ? await pg

package/dist/server/plugins/upload/startUpload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"startUpload.d.ts","sourceRoot":"","sources":["../../../../server/plugins/upload/startUpload.ts"],"names":[],"mappings":"AAoBA,wBAA8B,WAAW,CAAC,EACxC,IAAI,EACJ,EAAE,EACF,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,gBAAwB,GACzB,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,gBA6FA"}
+{"version":3,"file":"startUpload.d.ts","sourceRoot":"","sources":["../../../../server/plugins/upload/startUpload.ts"],"names":[],"mappings":"AAyBA,wBAA8B,WAAW,CAAC,EACxC,IAAI,EACJ,EAAE,EACF,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,gBAAwB,GACzB,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,gBA2GA"}

package/dist/server/plugins/upload/startUpload.js

@@ -4,20 +4,29 @@ import { mkdir, writeFile } from "node:fs/promises";
 import config from "../../../config.js";
 import getUploadStatus from "./getUploadStatus.js";
 import { prefix, fileDir, metaDir, uploadChunkDirectory, fetchTimeoutMs, } from "./index.js";
+import { all } from "../file/utils/allowedExtensions.js";
 import mimes from "../file/providers/mime/mimes.js";
 import { startUpload as startUploadS3 } from "./s3.js";
-import { BadRequestError, NotImplementedError } from "../../../errors.js";
+import { BadRequestError, ForbiddenError, NotImplementedError, } from "../../../errors.js";
 const { chunkSize = 5242880 } = config;
 export default async function startUpload({ host, id, fileName, size, subdir, originalFilename = false, }) {
-    if (subdir && (typeof subdir !== "string" || subdir.includes(".."))) {
+    if (subdir &&
+        (typeof subdir !== "string" ||
+            subdir.replace(/%2e/g, ".").replace(/%2E/g, ".").includes(".."))) {
         throw BadRequestError("invalid params: subdir");
     }
     if (originalFilename) {
         throw NotImplementedError("currently not supported");
     }
+    if (!fileName) {
+        throw BadRequestError("not enough params: fileName");
+    }
+    const extension = path.extname(fileName).substring(1);
+    if (!all.includes(extension)) {
+        throw ForbiddenError("file extension is not allowed");
+    }
     if (!host) {
         const id1 = id || randomUUID();
-        const extension = path.extname(fileName).substring(1);
         const yearMonthDay = subdir ? "" : new Date().toISOString().split("T")[0];
         const relativeDirpath = path
             .join(uploadChunkDirectory, subdir || "", yearMonthDay || "")

package/dist/server/plugins/usercls/index.d.ts

@@ -29,12 +29,11 @@ export declare function editUserCls({ name, alias, description, data, }: {
     alias?: string[];
     data: string | Record<string, any>[];
 }, pg?: any): Promise<string>;
-export declare function getUserClsList({ name, search, sql, custom, type, }: {
+export declare function getUserClsList({ name, search, sql, custom, }: {
     name?: string;
     search?: string;
     sql?: any;
     custom?: string;
-    type?: string;
 }, pg?: any): Promise<any>;
 export declare function getUserCls(name: string, pg?: any): Promise<{
     type: any;

package/dist/server/plugins/usercls/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/plugins/usercls/index.ts"],"names":[],"mappings":"AAMA,wBAAsB,YAAY,CAChC,EACE,IAAI,EACJ,WAAW,EACX,KAAK,EACL,KAAK,EACL,GAAG,EACH,IAAS,GACV,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE;QACJ,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,EAAE,CAAC;CACL,EACD,EAAE,MAAmB,mBA8EtB;AAED,wBAAsB,aAAa,CACjC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/C,EAAE,MAAmB,mBAgBtB;AAED,wBAAsB,UAAU,CAC9B,EACE,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC,EACD,EAAE,MAAmB,mBAqDtB;AAED,wBAAsB,WAAW,CAC/B,EACE,IAAI,EACJ,KAAK,EACL,WAAW,EACX,IAAI,GACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC,EACD,EAAE,MAAmB,mBAKtB;AAED,wBAAsB,cAAc,CAClC,EACE,IAAI,EACJ,MAAM,EACN,GAAG,EACH,MAAM,EACN,IAAI,GACL,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,EACD,EAAE,MAAmB,gBAgDtB;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAmB;;;;;UAsBnE;;AAED,wBAAoB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/plugins/usercls/index.ts"],"names":[],"mappings":"AAMA,wBAAsB,YAAY,CAChC,EACE,IAAI,EACJ,WAAW,EACX,KAAK,EACL,KAAK,EACL,GAAG,EACH,IAAS,GACV,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE;QACJ,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,EAAE,CAAC;CACL,EACD,EAAE,MAAmB,mBA8EtB;AAED,wBAAsB,aAAa,CACjC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/C,EAAE,MAAmB,mBAgBtB;AAED,wBAAsB,UAAU,CAC9B,EACE,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC,EACD,EAAE,MAAmB,mBAwDtB;AAED,wBAAsB,WAAW,CAC/B,EACE,IAAI,EACJ,KAAK,EACL,WAAW,EACX,IAAI,GACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC,EACD,EAAE,MAAmB,mBAKtB;AAED,wBAAsB,cAAc,CAClC,EACE,IAAI,EACJ,MAAM,EACN,GAAG,EACH,MAAM,GACP,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,MAAM,CAAC,EAAE,MAAM,CAAC;CAEjB,EACD,EAAE,MAAmB,gBA0DtB;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAmB;;;;;UAuBnE;;AAED,wBAAoB"}

package/dist/server/plugins/usercls/index.js

@@ -1,4 +1,4 @@
-import { NotFoundError } from "../../../errors.js";
+import { ForbiddenError, NotFoundError } from "../../../errors.js";
 import pgClients from "../pg/pgClients.js";
 import dataInsert from "../crud/funcs/dataInsert.js";
 import dataUpdate from "../crud/funcs/dataUpdate.js";
@@ -8,10 +8,10 @@ export async function addCustomCls({ name, description, alias, table, uid, data
     }
     const codes = await pg
         .query(`select array_agg(code) from ${table}`)
-        .then((el) => el.rows?.[0]?.array_agg || []);
+        .then((r) => r.rows?.[0]?.array_agg || []);
     const ids = await pg
         .query(`select json_object_agg(code, id) from ${table}`)
-        .then((el) => el.rows?.[0]?.json_object_agg || {});
+        .then((r) => r.rows?.[0]?.json_object_agg || {});
     const client = await pg.connect();
     try {
         await client.query("BEGIN");
@@ -88,6 +88,7 @@ export async function addUserCls({ name, alias, data, description, }, pg = pgCli
     try {
         await client.query("begin");
         if (type === "sql") {
+            throw ForbiddenError("access restricted: creation of custom selects is not allowed");
             await dataInsert({
                 pg: client,
                 table: "admin.user_cls",
@@ -126,23 +127,29 @@ export async function editUserCls({ name, alias, description, data, }, pg = pgCl
     await addUserCls({ name, alias, description, data }, pg);
     return "ok";
 }
-export async function getUserClsList({ name, search, sql, custom, type, }, pg = pgClients.client) {
-    const args = [name ? name.split(",") : null, search].filter(Boolean);
-    const typeStr = type ? { cls: "json", select: "sql" }[type] : null;
-    const idx = search && name ? 2 : 1;
-    const where = [
-        name ? "name=any($1::text[])" : null,
-        search
-            ? `( name ilike '%'||$${idx}||'%' or name in (select parent from admin.user_cls where name ilike '%'||$${idx}||'%') )`
-            : null,
-    ]
-        .filter(Boolean)
-        .join(" and ") || "1=1";
-    console.log(name, search, where);
+export async function getUserClsList({ name, search, sql, custom, }, pg = pgClients.client) {
+    const args = [];
+    const where = [];
+    if (name) {
+        args.push(name.split(","));
+        where.push(`name=any($${args.length}::text[])`);
+    }
+    if (search) {
+        args.push(`%${search}%`);
+        where.push(`( name ilike $${args.length} or name in (select parent from admin.user_cls where name ilike $${args.length}) )`);
+    }
+    // const typeStr = type ? { cls: "json", select: "sql" }[type] : null;
+    const typeStr = "json";
+    if (typeStr) {
+        args.push(typeStr);
+        where.push(`type=$${args.length}`);
+    }
+    const whereQuery = where.join(" and ") || "1=1";
+    console.log(name, search, whereQuery);
     const customQuery = `select true as custom, name, type, description, alias, case when type = 'sql' then 1 else (select count(*) from admin.user_cls where parent=t.name limit 1) end as count 
-  from admin.user_cls t where parent is null and ${where} and ${typeStr ? `type='${typeStr}'` : "true"}`;
+  from admin.user_cls t where parent is null and ${whereQuery}`;
     const gitQuery = `select false as custom, name, type, null as description, null as alias, case when type = 'sql' then 1 else (select count(*) from admin.cls where parent=t.name limit 1) end as count 
-  from admin.cls t where parent is null and ${where.replace(/admin.user_cls/g, "admin.cls")} and ${typeStr ? `type='${typeStr}'` : "true"}`;
+  from admin.cls t where parent is null and ${whereQuery.replace(/admin.user_cls/g, "admin.cls")}`;
     const q = [
         custom !== "0" ? customQuery : null,
         custom !== "1" ? gitQuery : null,
@@ -152,7 +159,7 @@ export async function getUserClsList({ name, search, sql, custom, type, }, pg =
         .concat(" order by name");
     if (sql)
         return q;
-    const rows = await pg.query(q, args).then((el) => el.rows || []);
+    const rows = await pg.query(q, args).then((r) => r.rows || []);
     const customRows = rows.filter((row) => row.custom);
     const customClsNames = customRows.map((row) => row.name);
     const filteredRows = rows.filter((row) => !customClsNames.includes(row.name));
@@ -161,14 +168,15 @@ export async function getUserClsList({ name, search, sql, custom, type, }, pg =
 export async function getUserCls(name, pg = pgClients.client) {
     const { type, data, description, alias } = await pg
         .query("select type, data, description, alias from admin.user_cls where parent is null and name=$1", [name])
-        .then((el) => el.rows?.[0] || {});
+        .then((r) => r.rows?.[0] || {});
     if (type === "sql") {
+        throw ForbiddenError("custom selects not allowed");
         return { type, data, description, alias };
     }
     if (type === "json") {
         const options = await pg
             .query(`select json_agg(json_build_object('id', code, 'text', name, 'icon', icon, 'color', color)) from admin.user_cls where parent=$1`, [name])
-            .then((el) => el.rows?.[0]?.json_agg || []);
+            .then((r) => r.rows?.[0]?.json_agg || []);
         return { type, data: options, description, alias };
     }
     return null;

package/dist/server/routes/file/controllers/resize.d.ts

@@ -13,5 +13,8 @@ export default function resize({ query, }: {
         format?: string;
         noimage?: any;
     };
-}, reply: FastifyReply): Promise<never>;
+}, reply: FastifyReply): Promise<import("fastify").FastifyError & {
+    code: "NOT_FOUND_ERROR";
+    statusCode: 404;
+}>;
 //# sourceMappingURL=resize.d.ts.map

package/dist/server/routes/file/controllers/resize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resize.d.ts","sourceRoot":"","sources":["../../../../../server/routes/file/controllers/resize.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA0C5C;;GAEG;AAEH,wBAA8B,MAAM,CAClC,EACE,KAAK,GACN,EAAE;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,OAAO,CAAC,EAAE,GAAG,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,GAAG,CAAC;KACf,CAAC;CACH,EACD,KAAK,EAAE,YAAY,kBA2IpB"}
+{"version":3,"file":"resize.d.ts","sourceRoot":"","sources":["../../../../../server/routes/file/controllers/resize.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA0C5C;;GAEG;AAEH,wBAA8B,MAAM,CAClC,EACE,KAAK,GACN,EAAE;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,OAAO,CAAC,EAAE,GAAG,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,GAAG,CAAC;KACf,CAAC;CACH,EACD,KAAK,EAAE,YAAY;;;GAyJpB"}

package/dist/server/routes/file/controllers/resize.js

@@ -8,7 +8,7 @@ isFileExists, getFolder, } from "../../../../utils.js";
 import grpc from "../../../plugins/grpc/grpc.js";
 import getMimeType from "../../../plugins/file/providers/mime/index.js";
 import { mkdir } from "node:fs/promises";
-import { BadRequestError } from "../../../../errors.js";
+import { BadRequestError, NotFoundError } from "../../../../errors.js";
 const defaultWidth = 400;
 const defaultHeight = 240;
 const maxWidth = 2000;
@@ -38,6 +38,19 @@ export default async function resize({ query, }, reply) {
     if (!mimeType) {
         throw BadRequestError("invalid query params: filepath");
     }
+    // svg не підтримується
+    if (mimeType === "image/svg+xml") {
+        const fileData = await downloadFile(filepath, { buffer: true });
+        if (!fileData?.length) {
+            return NotFoundError(`Файл не знайдено - ${filepath}`);
+        }
+        return reply
+            .headers({
+            "Content-Type": "image/svg+xml",
+            "Cache-control": "max-age=604800",
+        })
+            .send(fileData);
+    }
     const resizePath1 = size
         ? filepath.replace(basename, `${size}_resized_${basename}`)
         : filepath.replace(basename, `${w || defaultWidth}_${h || (w ? "" : defaultHeight)}_resized_${basename}`);

package/dist/server/routes/table/controllers/cardData.js

@@ -1,6 +1,5 @@
 /* eslint-disable no-param-reassign */
 import path from "node:path";
-import config from "../../../../config.js";
 import { handlebars, handlebarsSync } from "../../../helpers/index.js";
 import getAccess from "../../../plugins/crud/funcs/getAccess.js";
 import setToken from "../../../plugins/crud/funcs/setToken.js";
@@ -80,8 +79,9 @@ export default async function getCardData(req, reply) {
     }
     // tokens result
     const tokens = {};
-    if (!config.security?.disableToken &&
-        index?.tokens &&
+    if (
+    // !config.security?.disableToken &&
+    index?.tokens &&
         typeof index?.tokens === "object" &&
         !Array.isArray(index?.tokens)) {
         Object.keys(index.tokens || {})

package/dist/server/routes/table/controllers/suggest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../../../../server/routes/table/controllers/suggest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAwBpD,wBAAsB,kBAAkB,CAAC,EACvC,KAAK,EACL,QAAQ,EACR,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,GAAG,EACH,EAAqB,GACtB,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,GAAG,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,UAAU,CAAC;CACjB;;;;;UAwFA;AAED,wBAA8B,OAAO,CAAC,GAAG,EAAE,GAAG,gBAuY7C"}
+{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../../../../server/routes/table/controllers/suggest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAyBpD,wBAAsB,kBAAkB,CAAC,EACvC,KAAK,EACL,QAAQ,EACR,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,GAAG,EACH,EAAqB,GACtB,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,GAAG,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,UAAU,CAAC;CACjB;;;;;UAwFA;AAED,wBAA8B,OAAO,CAAC,GAAG,EAAE,GAAG,gBAoa7C"}

package/dist/server/routes/table/controllers/suggest.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import { existsSync, readFileSync } from "node:fs";
-import { config, getPGAsync, getTemplate, getSelectMeta, getMeta, applyHook, getSelectVal, logger, getSelect, metaFormat, getColumnCLS, pgClients, getFilter, } from "../../../../utils.js";
+import { config, getPGAsync, getTemplate, getSelectMeta, getMeta, applyHook, getSelectVal, logger, getSelect, metaFormat, getColumnCLS, pgClients, getFilter, getUserClsList, } from "../../../../utils.js";
 import { BadRequestError, NotFoundError } from "../../../../errors.js";
 const defaultLimit = 50;
 export async function getTableColumnMeta({ table, template, column, selectName, filtered, startsWith, key, pg = pgClients.client, }) {
@@ -91,6 +91,22 @@ export default async function suggest(req) {
             table,
         })) || {}
         : {};
+    if (params.data === "list" &&
+        (user?.user_type === "admin" || process.platform === "win32")) {
+        const cls = await getTemplate("cls", "list");
+        const select = await getTemplate("select", "list");
+        const custom = await getUserClsList({ custom: "1" }).then((r) => (r || []).reduce((acc, curr) => ({
+            ...acc,
+            [curr.name]: curr.type,
+        }), {}));
+        return {
+            git: (cls || []).concat(select || []).reduce((acc, curr) => ({
+                ...acc,
+                [curr[0]]: curr[2],
+            }), {}),
+            custom,
+        };
+    }
     const body = await getTemplate("table", table);
     const tableName = hookBody?.table || body?.table || table;
     if (query.limit && query.limit < 0) {

package/dist/server/routes/table/functions/getData.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getData.d.ts","sourceRoot":"","sources":["../../../../../server/routes/table/functions/getData.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAwFzD,wBAA8B,OAAO,CACnC,EACE,EAAqB,EACrB,MAAM,EACN,KAAK,EACL,EAAE,EACF,OAAY,EACZ,KAAU,EACV,IAAS,EACT,YAAY,EACZ,YAAY,EACZ,KAAY,EACZ,UAAU,EACV,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,EAAE,YAAY,EACrB,QAAgB,GACjB,EAAE;IACD,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,EACD,KAAK,CAAC,EAAE,YAAY,EACpB,MAAM,CAAC,EAAE,GAAG,gBA64Bb"}
+{"version":3,"file":"getData.d.ts","sourceRoot":"","sources":["../../../../../server/routes/table/functions/getData.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAwFzD,wBAA8B,OAAO,CACnC,EACE,EAAqB,EACrB,MAAM,EACN,KAAK,EACL,EAAE,EACF,OAAY,EACZ,KAAU,EACV,IAAS,EACT,YAAY,EACZ,YAAY,EACZ,KAAY,EACZ,UAAU,EACV,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,EAAE,YAAY,EACrB,QAAgB,GACjB,EAAE;IACD,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,EACD,KAAK,CAAC,EAAE,YAAY,EACpB,MAAM,CAAC,EAAE,GAAG,gBAw4Bb"}

package/dist/server/routes/table/functions/getData.js

@@ -209,14 +209,14 @@ export default async function dataAPI({ pg = pgClients.client, params, table, id
         !el.inline &&
         el?.sql?.replace &&
         !(isExport && el.export === false))
-        .map((el, i) => ` left join lateral (${el.sql.replace("{{uid}}", `$${idx.uid}`)}) ${el.name || `t${i}`} on 1=1 `)
+        .map((el, i) => ` left join lateral (${el.sql}) ${el.name || `t${i}`} on 1=1 `)
         ?.join("") || "";
     const cardSqlFiltered = objectId
         ? cardSql?.filter?.((el) => !el?.disabled && el?.name && el?.sql?.replace) || []
         : [];
     const cardSqlTable = cardSqlFiltered.length
         ? cardSqlFiltered
-            .map((el, i) => ` left join lateral (${el.sql.replace("{{uid}}", `$${idx.uid}`)}) ct${i}  on 1=1 `)
+            .map((el, i) => ` left join lateral (${el.sql}) ct${i}  on 1=1 `)
             .join("\n") || ""
         : "";
     const sqlInline = loadTable?.sql
@@ -385,7 +385,7 @@ export default async function dataAPI({ pg = pgClients.client, params, table, id
     timeArr.push(Date.now());
     if (uid &&
         rows.length &&
-        !config.security?.disableToken &&
+        // !config.security?.disableToken &&
         (editable ||
             (tokenData?.actions || actionsParam)?.includes("edit") ||
             actions.includes("edit") ||
@@ -507,8 +507,9 @@ export default async function dataAPI({ pg = pgClients.client, params, table, id
     const tokens = {};
     if (template && objectId) {
         // tokens result
-        if (!config.security?.disableToken &&
-            index?.tokens &&
+        if (
+        // !config.security?.disableToken &&
+        index?.tokens &&
             typeof index?.tokens === "object" &&
             !Array.isArray(index?.tokens)) {
             Object.keys(index.tokens || {})
@@ -682,7 +683,7 @@ export default async function dataAPI({ pg = pgClients.client, params, table, id
         });
     }
     if (uid &&
-        !config.security?.disableToken &&
+        // !config.security?.disableToken &&
         actions.includes("add") &&
         !objectId) {
         const addTokens = setToken({

package/dist/server/routes/usercls/controllers/addUserCls.d.ts

@@ -1,2 +1,9 @@
-export default function addUserClsApi({ pg, body, user }: any, reply: any): Promise<any>;
+export default function addUserClsApi({ pg, body, user, }: any): Promise<{
+    type?: any;
+    data?: any;
+    description?: any;
+    alias?: any;
+    time: number;
+    name: any;
+}>;
 //# sourceMappingURL=addUserCls.d.ts.map

package/dist/server/routes/usercls/controllers/addUserCls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"addUserCls.d.ts","sourceRoot":"","sources":["../../../../../server/routes/usercls/controllers/addUserCls.ts"],"names":[],"mappings":"AAWA,wBAA8B,aAAa,CACzC,EAAE,EAAqB,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAC1C,KAAK,EAAE,GAAG,gBAqCX"}
+{"version":3,"file":"addUserCls.d.ts","sourceRoot":"","sources":["../../../../../server/routes/usercls/controllers/addUserCls.ts"],"names":[],"mappings":"AAWA,wBAA8B,aAAa,CAAC,EAC1C,EAAqB,EACrB,IAAI,EACJ,IAAI,GACL,EAAE,GAAG;;;;;;;GAkCL"}

package/dist/server/routes/usercls/controllers/addUserCls.js

@@ -2,7 +2,7 @@ import { UnauthorizedError } from "../../../../errors.js";
 import pgClients from "../../../plugins/pg/pgClients.js";
 import getSelectMeta from "../../../plugins/table/funcs/getSelectMeta.js";
 import { addUserCls, addCustomCls, editUserCls, getUserCls, } from "../../../plugins/usercls/index.js";
-export default async function addUserClsApi({ pg = pgClients.client, body, user }, reply) {
+export default async function addUserClsApi({ pg = pgClients.client, body, user, }) {
     const { name, description, alias, data, table } = body;
     const t1 = Date.now();
     if (!user?.uid) {
@@ -10,9 +10,7 @@ export default async function addUserClsApi({ pg = pgClients.client, body, user
     }
     if (table) {
         await addCustomCls({ name, description, alias, table, uid: user.uid, data }, pg);
-        return reply
-            .status(200)
-            .send({ time: Date.now() - t1, name, type: "custom" });
+        return { time: Date.now() - t1, name, type: "custom" };
     }
     const exists = await getUserCls(name, pg);
     if (exists) {
@@ -28,5 +26,5 @@ export default async function addUserClsApi({ pg = pgClients.client, body, user
         nocache: 1,
     });
     const result = await getUserCls(name, pg);
-    return reply.status(200).send({ time: Date.now() - t1, name, ...result });
+    return { time: Date.now() - t1, name, ...result };
 }

package/dist/server/routes/usercls/controllers/getUserCls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getUserCls.d.ts","sourceRoot":"","sources":["../../../../../server/routes/usercls/controllers/getUserCls.ts"],"names":[],"mappings":"AASA,wBAA8B,iBAAiB,CAAC,EAC9C,KAAK,EACL,IAAI,EACJ,EAAqB,GACtB,EAAE,GAAG,gBAyBL"}
+{"version":3,"file":"getUserCls.d.ts","sourceRoot":"","sources":["../../../../../server/routes/usercls/controllers/getUserCls.ts"],"names":[],"mappings":"AAaA,wBAA8B,iBAAiB,CAAC,EAC9C,KAAK,EACL,IAAI,EACJ,EAAqB,GACtB,EAAE,GAAG,gBA2CL"}

package/dist/server/routes/usercls/controllers/getUserCls.js

@@ -2,6 +2,8 @@ import config from "../../../../config.js";
 import { UnauthorizedError } from "../../../../errors.js";
 import pgClients from "../../../plugins/pg/pgClients.js";
 import { getUserClsList } from "../../../plugins/usercls/index.js";
+const customQueryCount = "select count(*)from admin.user_cls t where parent is null and type<>'sql'";
+const gitQueryCount = "select count(*)from admin.cls t where parent is null";
 // query.name = cls1,cls2,cls3
 // query.search = substring of cls name
 // data[idx].count - should not depend on either query.name or query.search
@@ -16,11 +18,25 @@ export default async function getUserClsListApi({ query, user, pg = pgClients.cl
     const result = await getUserClsList({
         name: query.name,
         search: query.search,
-        type: query.type,
+        // type: query.type,
         custom: query.custom,
         sql: query.sql,
     }, pg);
     if (query.sql)
         return result;
-    return { time: Date.now() - t1, filtered: result.length, data: result };
+    const promises = [
+        query.custom === "0" || !query.custom
+            ? pg.query(gitQueryCount).then((r) => r.rows?.[0]?.count || 0)
+            : null,
+        query.custom === "1" || !query.custom
+            ? pg.query(customQueryCount).then((r) => r.rows?.[0]?.count || 0)
+            : null,
+    ];
+    const total = await Promise.all(promises).then((r) => r.reduce((a, b) => +a + +b, 0));
+    return {
+        time: Date.now() - t1,
+        total,
+        filtered: result.length,
+        data: result,
+    };
 }

package/package.json

@@ -1,99 +1,99 @@
-{
-  "name": "@opengis/fastify-table",
-  "version": "2.5.18",
-  "type": "module",
-  "description": "core-plugins",
-  "keywords": [
-    "fastify",
-    "table",
-    "crud",
-    "auth",
-    "pg",
-    "backend"
-  ],
-  "main": "dist/index.js",
-  "exports": {
-    ".": "./dist/index.js",
-    "./index.js": "./dist/index.js",
-    "./errors.js": "./dist/errors.js",
-    "./utils.js": "./dist/utils.js",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "dist/*"
-  ],
-  "scripts": {
-    "dump": "bun ./script/dump.ts",
-    "migrate": "bun ./script/migrate.ts",
-    "dump1": "bun ./dist/script/dump.js",
-    "migrate1": "bun ./dist/script/migrate.js",
-    "prepublishOnly": "npm run build",
-    "clean": "tsc -b --clean",
-    "build": "tsc -b --clean && tsc && copyfiles server/plugins/grpc/utils/*.proto dist && copyfiles server/migrations/*.sql dist && copyfiles server/templates/**/*.html dist && copyfiles server/templates/**/*.hbs dist && copyfiles script/* dist && copyfiles -u 2 module/core/*/* dist/module/core",
-    "prod": "NODE_ENV=production bun dist/server",
-    "patch": "npm version patch && git push && npm publish",
-    "minor": "npm version minor && git push && npm publish",
-    "major": "npm version major && git push && npm publish",
-    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore",
-    "test": "npx vitest run",
-    "compress": "node compress.js",
-    "dev1": "bun --hot dist/server",
-    "dev": "NODE_ENV=development bun start",
-    "start": "LOG_LEVEL=trace bun server",
-    "start1": "npx tsx server"
-  },
-  "dependencies": {
-    "@aws-sdk/client-s3": "3.1079.0",
-    "@aws-sdk/lib-storage": "3.1079.0",
-    "@fastify/cookie": "11.0.2",
-    "@fastify/http-proxy": "11.5.0",
-    "@fastify/multipart": "10.0.0",
-    "@fastify/passport": "3.0.2",
-    "@fastify/rate-limit": "11.1.0",
-    "@fastify/session": "11.1.1",
-    "@grpc/grpc-js": "1.14.4",
-    "@grpc/proto-loader": "0.8.1",
-    "apache-crypt": "1.2.6",
-    "dotenv": "17.4.2",
-    "fastify": "5.9.0",
-    "fastify-plugin": "6.0.0",
-    "fastify-session-redis-store": "7.1.2",
-    "file-type": "^22.0.1",
-    "handlebars": "4.7.9",
-    "image-size": "2.0.2",
-    "ioredis": "5.11.1",
-    "js-yaml": "5.2.1",
-    "markdown-it": "14.3.0",
-    "minio": "^8.0.7",
-    "nodemailer": "9.0.3",
-    "otplib": "13.4.1",
-    "pg": "8.22.0",
-    "pino": "10.3.1",
-    "pino-abstract-transport": "3.0.0",
-    "promised-handlebars": "2.0.1",
-    "qrcode": "1.5.4",
-    "sharp": "0.35.3",
-    "uglify-js": "3.19.3",
-    "undici": "8.6.0"
-  },
-  "devDependencies": {
-    "@stylistic/eslint-plugin": "^5.10.0",
-    "@types/bun": "^1.3.5",
-    "@types/js-yaml": "^4.0.9",
-    "@types/markdown-it": "^14.1.2",
-    "@types/node": "^26.1.0",
-    "@types/nodemailer": "^8.0.1",
-    "@types/passport": "^1.0.17",
-    "@types/passport-local": "^1.0.38",
-    "@types/pg": "^8.20.0",
-    "@types/qrcode": "^1.5.6",
-    "copyfiles": "^2.4.1",
-    "eslint": "^10.6.0",
-    "eslint-stylistic-airbnb": "^3.2.0",
-    "ts-migrate": "^0.1.35",
-    "typescript": "^6.0.2",
-    "vitest": "^4.1.2"
-  },
-  "author": "Softpro",
-  "license": "ISC"
-}
+{
+  "name": "@opengis/fastify-table",
+  "version": "2.5.21",
+  "type": "module",
+  "description": "core-plugins",
+  "keywords": [
+    "fastify",
+    "table",
+    "crud",
+    "auth",
+    "pg",
+    "backend"
+  ],
+  "main": "dist/index.js",
+  "exports": {
+    ".": "./dist/index.js",
+    "./index.js": "./dist/index.js",
+    "./errors.js": "./dist/errors.js",
+    "./utils.js": "./dist/utils.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist/*"
+  ],
+  "scripts": {
+    "dump": "bun ./script/dump.ts",
+    "migrate": "bun ./script/migrate.ts",
+    "dump1": "bun ./dist/script/dump.js",
+    "migrate1": "bun ./dist/script/migrate.js",
+    "prepublishOnly": "npm run build",
+    "clean": "tsc -b --clean",
+    "build": "tsc -b --clean && tsc && copyfiles server/plugins/grpc/utils/*.proto dist && copyfiles server/migrations/*.sql dist && copyfiles server/templates/**/*.html dist && copyfiles server/templates/**/*.hbs dist && copyfiles script/* dist && copyfiles -u 2 module/core/*/* dist/module/core",
+    "prod": "NODE_ENV=production bun dist/server",
+    "patch": "npm version patch && git push && npm publish",
+    "minor": "npm version minor && git push && npm publish",
+    "major": "npm version major && git push && npm publish",
+    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore",
+    "test": "npx vitest run",
+    "compress": "node compress.js",
+    "dev1": "bun --hot dist/server",
+    "dev": "NODE_ENV=development bun start",
+    "start": "LOG_LEVEL=trace bun server",
+    "start1": "npx tsx server"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "3.1079.0",
+    "@aws-sdk/lib-storage": "3.1079.0",
+    "@fastify/cookie": "11.0.2",
+    "@fastify/http-proxy": "11.5.0",
+    "@fastify/multipart": "10.0.0",
+    "@fastify/passport": "3.0.2",
+    "@fastify/rate-limit": "11.1.0",
+    "@fastify/session": "11.1.1",
+    "@grpc/grpc-js": "1.14.4",
+    "@grpc/proto-loader": "0.8.1",
+    "apache-crypt": "1.2.6",
+    "dotenv": "17.4.2",
+    "fastify": "5.9.0",
+    "fastify-plugin": "6.0.0",
+    "fastify-session-redis-store": "7.1.2",
+    "file-type": "^22.0.1",
+    "handlebars": "4.7.9",
+    "image-size": "2.0.2",
+    "ioredis": "5.11.1",
+    "js-yaml": "5.2.1",
+    "markdown-it": "14.3.0",
+    "minio": "^8.0.7",
+    "nodemailer": "9.0.3",
+    "otplib": "13.4.1",
+    "pg": "8.22.0",
+    "pino": "10.3.1",
+    "pino-abstract-transport": "3.0.0",
+    "promised-handlebars": "2.0.1",
+    "qrcode": "1.5.4",
+    "sharp": "0.35.3",
+    "uglify-js": "3.19.3",
+    "undici": "8.6.0"
+  },
+  "devDependencies": {
+    "@stylistic/eslint-plugin": "^5.10.0",
+    "@types/bun": "^1.3.5",
+    "@types/js-yaml": "^4.0.9",
+    "@types/markdown-it": "^14.1.2",
+    "@types/node": "^26.1.0",
+    "@types/nodemailer": "^8.0.1",
+    "@types/passport": "^1.0.17",
+    "@types/passport-local": "^1.0.38",
+    "@types/pg": "^8.20.0",
+    "@types/qrcode": "^1.5.6",
+    "copyfiles": "^2.4.1",
+    "eslint": "^10.6.0",
+    "eslint-stylistic-airbnb": "^3.2.0",
+    "ts-migrate": "^0.1.35",
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.2"
+  },
+  "author": "Softpro",
+  "license": "ISC"
+}