@opengis/fastify-table 2.5.69 → 2.5.71

package/dist/module/core/select/core.user_mentioned.json

@@ -0,0 +1,3 @@
+{
+    "public": true
+}

package/dist/server/plugins/table/funcs/getSelectMeta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSelectMeta.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/table/funcs/getSelectMeta.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAWzD,wBAA8B,aAAa,CAAC,EAC1C,IAAI,EACJ,UAAU,EACV,GAAG,EACH,OAAO,EACP,MAAM,EACN,IAAI,EACJ,EAAqB,GACtB,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,GAAG,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,UAAU,CAAC;CACjB,gBAmIA"}
+{"version":3,"file":"getSelectMeta.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/table/funcs/getSelectMeta.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAWzD,wBAA8B,aAAa,CAAC,EAC1C,IAAI,EACJ,UAAU,EACV,GAAG,EACH,OAAO,EACP,MAAM,EACN,IAAI,EACJ,EAAqB,GACtB,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,GAAG,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,UAAU,CAAC;CACjB,gBAoIA"}

package/dist/server/plugins/table/funcs/getSelectMeta.js

@@ -94,6 +94,7 @@ export default async function getSelectMeta({ name, startsWith, key, nocache, pa
         searchQuery,
         table: tableNew.join(","),
         time: new Date().toISOString(),
+        access: cls.public === false ? "user" : "public",
     };
     selectMeta[name] = data;
     // on demand - search by "start with these characters"

package/dist/server/routes/auth/controllers/jwt/authorize.js

@@ -26,7 +26,9 @@ export default async function authorize(req, reply) {
     }
     const ip = getIp(req);
     const q = `select * from oauth.clients where client_id=$1 and token_endpoint_auth_method=$2 and (allowed_ips is null or $3=any(allowed_ips)) and ${scope ? "$4=any(scopes)" : "1=1"} order by allowed_ips nulls last limit 1`;
-    const { owner_user_id: userId, client_secret_hash: secret, redirect_uris = [], scopes, allowed_ips: allowedIPs = [], } = pg.pk?.["oauth.clients"]
+    const { owner_user_id: userId, client_secret_hash: secret, redirect_uris = [], scopes,
+    // allowed_ips: allowedIPs = [],
+     } = pg.pk?.["oauth.clients"]
         ? await pg
             .query(q, [client_id, "private_key_jwt", ip, scope].filter(Boolean))
             .then((el) => el.rows?.[0] || {})

package/dist/server/routes/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/routes/auth/index.ts"],"names":[],"mappings":"AAgDA,iBAAS,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAE,GAAQ,QAuGtC;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/routes/auth/index.ts"],"names":[],"mappings":"AA6DA,iBAAS,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAE,GAAQ,QAsGtC;AAED,eAAe,MAAM,CAAC"}

package/dist/server/routes/auth/index.js

@@ -23,6 +23,19 @@ import qrCode from "./controllers/2factor/qrcode.js";
 const tags = ["core", "auth"];
 const packageName = "fastify-table";
 const params = { config: { policy: "L0", tags, package: packageName } };
+const loginApiParams = {
+    config: {
+        policy: "L0",
+        tags,
+        package: packageName,
+        rateLimit: config.rateLimit
+            ? {
+                max: +(config.rateLimit?.login?.max || 5),
+                timeWindow: config.rateLimit?.login?.timeWindow || "1 minute",
+            }
+            : undefined,
+    },
+};
 const registrationSchema = {
     body: {
         type: "object",
@@ -44,13 +57,11 @@ function plugin(app, opt = {}) {
         app.get("/logout", params, logout);
     }
     if (!app.hasRoute({ method: "GET", url: "/api/login" }) &&
-        process.env.DISABLE_GET_LOGIN !== "true"
-    // && process.env.platform === "win32"
-    ) {
-        app.get("/api/login", params, login);
+        process.env.DISABLE_GET_LOGIN !== "true") {
+        app.get("/api/login", loginApiParams, login);
     }
     if (!app.hasRoute({ method: "POST", url: "/api/login" })) {
-        app.post("/api/login", params, login);
+        app.post("/api/login", loginApiParams, login);
     }
     if (!app.hasRoute({ method: "POST", url: "/api/registration" })) {
         app.post("/api/registration", { ...params, schema: registrationSchema }, registration);

package/dist/server/routes/table/controllers/suggest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../../../../server/routes/table/controllers/suggest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AA+BpD,wBAAsB,kBAAkB,CAAC,EACvC,KAAK,EACL,QAAQ,EACR,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,GAAG,EACH,EAAqB,GACtB,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,GAAG,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,UAAU,CAAC;CACjB;;;;;;UAyGA;AAED,wBAA8B,OAAO,CAAC,GAAG,EAAE,GAAG,gBA6d7C"}
+{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../../../../server/routes/table/controllers/suggest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAgCpD,wBAAsB,kBAAkB,CAAC,EACvC,KAAK,EACL,QAAQ,EACR,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,GAAG,EACH,EAAqB,GACtB,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,GAAG,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,UAAU,CAAC;CACjB;;;;;;UAyGA;AAED,wBAA8B,OAAO,CAAC,GAAG,EAAE,GAAG,gBAqe7C"}

package/dist/server/routes/table/controllers/suggest.js

@@ -131,12 +131,11 @@ export default async function suggest(req) {
     const table2 = table1 || query.token;
     const table = resources[table2] || table2;
     const column = column1 || query.column;
-    const { body: hookBody } = table
-        ? (await applyHook("preSuggest", {
-            pg: pg1,
-            table,
-        })) || {}
-        : {};
+    const { body: hookBody } = (await applyHook("preSuggest", {
+        pg: pg1,
+        table, // old hook support
+        data: params.data, // in case of need for additional security checks
+    })) || {};
     if (params.data === "list" &&
         (user?.user_type === "admin" || process.platform === "win32")) {
         const cls = await getTemplate("cls", "list");
@@ -154,6 +153,9 @@ export default async function suggest(req) {
         };
     }
     const body = await getTemplate("table", table);
+    if (body && !user?.uid && body.public !== true) {
+        throw ForbiddenError("authorization required");
+    }
     if (table && !hookBody?.table && !body?.table) {
         throw ForbiddenError("invalid params: table");
     }
@@ -185,6 +187,9 @@ export default async function suggest(req) {
             lang: query.lang,
             parent,
         });
+    if (meta?.access === "user" && !user?.uid) {
+        throw ForbiddenError("authorization required");
+    }
     if (meta?.minLength && query.key && query.key.length < meta?.minLength) {
         throw BadRequestError(`min length: ${meta.minLength}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "2.5.69",
+  "version": "2.5.71",
   "type": "module",
   "description": "core-plugins",
   "keywords": [