@saltcorn/data 0.5.5-beta.1 → 0.5.6-beta.2

package/base-plugin/viewtemplates/edit.js

@@ -522,6 +522,9 @@ const authorise_post = async ({ body, table_id, req }) => {
     const field_name = await table.owner_fieldname();
     return field_name && `${body[field_name]}` === `${user_id}`;
   }
+  if (table.ownership_formula && user_id) {
+    return await table.is_owner(req.user, body);
+  }
   if (table.name === "users" && `${body.id}` === `${user_id}`) return true;
   return false;
 };

package/base-plugin/viewtemplates/filter.js

@@ -103,6 +103,10 @@ const run = async (table_id, viewname, { columns, layout }, state, extra) => {
         if (kpath.length === 3) {
           const [jtNm, jFieldNm, lblField] = kpath;
           const jtable = await Table.findOne({ name: jtNm });
+          if (!jtable)
+            throw new InvalidConfiguration(
+              `View ${viewname} incorrectly configured: cannot find join table ${jtNm}`
+            );
           const jfields = await jtable.getFields();
           const jfield = jfields.find((f) => f.name === lblField);
           if (jfield)

package/base-plugin/viewtemplates/show.js

@@ -344,6 +344,13 @@ const renderRows = async (
         segment.contents = await view.run(state, extra);
       }
     });
+    const user_id = extra.req.user ? extra.req.user.id : null;
+
+    const is_owner =
+      table.ownership_formula && user_id
+        ? await table.is_owner(extra.req.user, row)
+        : owner_field && user_id && row[owner_field] === user_id;
+
     return render(
       row,
       fields,
@@ -352,7 +359,7 @@ const renderRows = async (
       table,
       role,
       extra.req,
-      owner_field
+      is_owner
     );
   });
 };
@@ -393,18 +400,7 @@ const runMany = async (
   return rendered.map((html, ix) => ({ html, row: rows[ix] }));
 };
 
-const render = (
-  row,
-  fields,
-  layout0,
-  viewname,
-  table,
-  role,
-  req,
-  owner_field
-) => {
-  const user_id = req.user ? req.user.id : null;
-  const is_owner = owner_field && user_id && row[owner_field] === user_id;
+const render = (row, fields, layout0, viewname, table, role, req, is_owner) => {
   const evalMaybeExpr = (segment, key, fmlkey) => {
     if (segment.isFormula && segment.isFormula[fmlkey || key]) {
       const f = get_expression_function(segment[key], fields);

package/base-plugin/viewtemplates/viewable_fields.js

@@ -261,11 +261,7 @@ const get_viewable_fields = contract(
             label: column.header_label ? text(__(column.header_label)) : "",
             key: (r) => {
               if (action_requires_write(column.action_name)) {
-                const owner_field = table.owner_fieldname_from_fields(fields);
-                if (
-                  table.min_role_write < role &&
-                  (!owner_field || r[owner_field] !== user_id)
-                )
+                if (table.min_role_write < role && !table.is_owner(req.user, r))
                   return "";
               }
               const url = action_url(
@@ -524,9 +520,11 @@ const fill_presets = async (table, req, fixed) => {
       if (fixed[k]) {
         const fldnm = k.replace("preset_", "");
         const fld = fields.find((f) => f.name === fldnm);
-        if (table.name === "users" && fld.primary_key)
-          fixed[fldnm] = req.user ? req.user.id : null;
-        else fixed[fldnm] = fld.presets[fixed[k]]({ user: req.user, req });
+        if (fld) {
+          if (table.name === "users" && fld.primary_key)
+            fixed[fldnm] = req.user ? req.user.id : null;
+          else fixed[fldnm] = fld.presets[fixed[k]]({ user: req.user, req });
+        }
       }
       delete fixed[k];
     } else {

package/db/state.js

@@ -46,6 +46,7 @@ class State {
     this.viewtemplates = {};
     this.tables = [];
     this.types = {};
+    this.stashed_fieldviews = {};
     this.files = {};
     this.pages = [];
     this.fields = [];
@@ -355,6 +356,10 @@ class State {
       if (type) {
         if (type.fieldviews) type.fieldviews[k] = v;
         else type.fieldviews = { [k]: v };
+      } else {
+        if (!this.stashed_fieldviews[v.type])
+          this.stashed_fieldviews[v.type] = {};
+        this.stashed_fieldviews[v.type][k] = v;
       }
     });
     const layout = withCfg("layout");
@@ -383,7 +388,13 @@ class State {
    * @param t
    */
   addType(t) {
-    this.types[t.name] = { ...t, fieldviews: { ...t.fieldviews } };
+    this.types[t.name] = {
+      ...t,
+      fieldviews: {
+        ...t.fieldviews,
+        ...(this.stashed_fieldviews[t.name] || {}),
+      },
+    };
   }
 
   /**
@@ -405,6 +416,7 @@ class State {
   async refresh_plugins(noSignal) {
     this.viewtemplates = {};
     this.types = {};
+    this.stashed_fieldviews = {};
     this.fields = [];
     this.fileviews = {};
     this.actions = {};
@@ -431,7 +443,9 @@ class State {
     this.pages.forEach((p) => strings.push(...p.getStringsForI18n()));
     const menu = this.getConfig("menu_items", []);
     strings.push(...menu.map(({ label }) => label));
-    return Array.from(new Set(strings)).filter(removeAllWhiteSpace);
+    return Array.from(new Set(strings)).filter(
+      (s) => s && removeAllWhiteSpace(s)
+    );
   }
 
   setRoomEmitter(f) {

package/migrations/202109201624.js

@@ -0,0 +1,3 @@
+const sql = "alter table _sc_tables add column ownership_formula text";
+
+module.exports = { sql };

package/models/backup.js

@@ -6,6 +6,7 @@ const View = require("./view");
 const File = require("./file");
 const Plugin = require("./plugin");
 const User = require("./user");
+const Role = require("./role");
 const Page = require("./page");
 const Zip = require("adm-zip");
 const tmp = require("tmp-promise");
@@ -26,6 +27,7 @@ const {
 const { is_plugin } = require("../contracts");
 
 const { asyncMap } = require("../utils");
+const Trigger = require("./trigger");
 
 const create_pack = contract(
   is.fun(is.str, is.promise(is.undefined)),
@@ -46,7 +48,9 @@ const create_pack = contract(
       await Page.find({}),
       async (v) => await page_pack(v.name)
     );
-    var pack = { tables, views, plugins, pages };
+    const triggers = (await Trigger.find({})).map((tr) => tr.toJson);
+    const roles = await Role.find({});
+    var pack = { tables, views, plugins, pages, triggers, roles };
 
     await fs.writeFile(path.join(dirpath, "pack.json"), JSON.stringify(pack));
   }
@@ -175,7 +179,8 @@ const restore_files = contract(
         //set location
         file.location = newPath;
         //insert in db
-        await db.insert("_sc_files", file);
+        const { user_id, ...file_row } = file;
+        await db.insert("_sc_files", file_row);
       }
     }
   }

package/models/pack.js

@@ -10,6 +10,8 @@ const { contract, is } = require("contractis");
 const Page = require("./page");
 const { is_pack, is_plugin } = require("../contracts");
 const TableConstraint = require("./table_constraints");
+const { tr } = require("@saltcorn/markup/tags");
+const Role = require("./role");
 
 const pack_fun = is.fun(is.str, is.promise(is.obj()));
 
@@ -21,7 +23,7 @@ const table_pack = contract(pack_fun, async (name) => {
     delete o.table_id;
     return o;
   };
-  const triggers = await Trigger.find({ table_id: table.id });
+  //const triggers = await Trigger.find({ table_id: table.id });
   const constraints = await TableConstraint.find({ table_id: table.id });
 
   return {
@@ -29,8 +31,9 @@ const table_pack = contract(pack_fun, async (name) => {
     min_role_read: table.min_role_read,
     min_role_write: table.min_role_write,
     versioned: table.versioned,
+    ownership_formula: table.ownership_formula,
     fields: fields.map((f) => strip_ids(f.toJson)),
-    triggers: triggers.map((tr) => tr.toJson),
+    //triggers: triggers.map((tr) => tr.toJson),
     constraints: constraints.map((c) => c.toJson),
     ownership_field_name: table.owner_fieldname_from_fields(fields),
   };
@@ -200,6 +203,9 @@ const install_pack = contract(
         await loadAndSaveNewPlugin(p);
       }
     }
+    for (const role of pack.roles || []) {
+      await Role.create(role);
+    }
     for (const tableSpec of pack.tables) {
       if (tableSpec.name !== "users") {
         const table = await Table.create(tableSpec.name, tableSpec);
@@ -226,7 +232,7 @@ const install_pack = contract(
         }
       }
       for (const trigger of tableSpec.triggers || [])
-        await Trigger.create({ table, ...trigger });
+        await Trigger.create({ table, ...trigger }); //legacy, not in new packs
       for (const constraint of tableSpec.constraints || [])
         await TableConstraint.create({ table, ...constraint });
       if (tableSpec.ownership_field_name) {
@@ -258,6 +264,10 @@ const install_pack = contract(
           min_role: viewSpec.min_role || 10,
         });
     }
+    for (const triggerSpec of pack.triggers || []) {
+      await Trigger.create(triggerSpec);
+    }
+
     for (const pageFullSpec of pack.pages || []) {
       const { root_page_for_roles, menu_label, ...pageSpec } = pageFullSpec;
       await Page.create(pageSpec);

package/models/table.js

@@ -10,6 +10,7 @@ const {
   apply_calculated_fields,
   apply_calculated_fields_stored,
   recalculate_for_stored,
+  get_expression_function,
 } = require("./expression");
 const { contract, is } = require("contractis");
 const { is_table_query } = require("../contracts");
@@ -87,6 +88,7 @@ class Table {
     this.min_role_read = o.min_role_read;
     this.min_role_write = o.min_role_write;
     this.ownership_field_id = o.ownership_field_id;
+    this.ownership_formula = o.ownership_formula;
     this.versioned = !!o.versioned;
     this.external = false;
     this.description = o.description;
@@ -178,11 +180,10 @@ class Table {
    * Get owner column name
    * @returns {Promise<string|null|*>}
    */
-  async owner_fieldname() {
+  owner_fieldname() {
     if (this.name === "users") return "id";
     if (!this.ownership_field_id) return null;
-    const fields = await this.getFields();
-    return this.owner_fieldname_from_fields(fields);
+    return this.owner_fieldname_from_fields(this.fields);
   }
 
   /**
@@ -191,9 +192,13 @@ class Table {
    * @param row - table row
    * @returns {Promise<string|null|*|boolean>}
    */
-  async is_owner(user, row) {
+  is_owner(user, row) {
     if (!user) return false;
-    const field_name = await this.owner_fieldname();
+    if (this.ownership_formula) {
+      const f = get_expression_function(this.ownership_formula, this.fields);
+      return f(row, user);
+    }
+    const field_name = this.owner_fieldname();
     return field_name && row[field_name] === user.id;
   }
 
@@ -218,6 +223,7 @@ class Table {
       min_role_read: options.min_role_read || 1,
       min_role_write: options.min_role_write || 1,
       ownership_field_id: options.ownership_field_id,
+      ownership_formula: options.ownership_formula,
       description: options.description || "",
     };
     // insert table defintion into _sc_tables
@@ -990,10 +996,18 @@ class Table {
         const throughTable = await Table.findOne({
           name: reffield.reftable_name,
         });
+        if (!throughTable)
+          throw new InvalidConfiguration(
+            `Join-through table ${reffield.reftable_name} not found`
+          );
         const throughTableFields = await throughTable.getFields();
         const throughRefField = throughTableFields.find(
           (f) => f.name === through
         );
+        if (!throughRefField)
+          throw new InvalidConfiguration(
+            `Reference field field ${through} not found in table ${throughTable.name}`
+          );
         const finalTable = throughRefField.reftable_name;
         const jtNm1 = `${sqlsanitize(reftable)}_jt_${sqlsanitize(
           through

package/models/trigger.js

@@ -39,13 +39,19 @@ class Trigger {
    * @returns {{when_trigger, configuration: any, name, description, action}}
    */
   get toJson() {
+    let table_name = this.table_name;
+    if (!table_name && this.table_id) {
+      const Table = require("./table");
+      const table = Table.find(+this.table_id);
+      table_name = table.name;
+    }
     return {
       name: this.name,
       description: this.description,
       action: this.action,
       when_trigger: this.when_trigger,
       configuration: this.configuration,
-      table_id: this.table_id,
+      table_name,
       channel: this.channel,
       min_role: this.min_role,
     };
@@ -116,6 +122,11 @@ class Trigger {
   static async create(f) {
     const trigger = new Trigger(f);
     const { id, table_name, ...rest } = trigger;
+    if (table_name && !rest.table_id) {
+      const Table = require("./table");
+      const table = Table.find(table_name);
+      rest.table_id = table.id;
+    }
     const fid = await db.insert("_sc_triggers", rest);
     trigger.id = fid;
     await require("../db/state").getState().refresh_triggers();

package/models/user.js

@@ -5,6 +5,24 @@ const { v4: uuidv4 } = require("uuid");
 const dumbPasswords = require("dumb-passwords");
 const validator = require("email-validator");
 
+const safeUserFields = (o) => {
+  const {
+    email,
+    password,
+    language,
+    _attributes,
+    api_token,
+    verification_token,
+    verified_on,
+    disabled,
+    id,
+    reset_password_token,
+    reset_password_expiry,
+    role_id,
+    ...rest
+  } = o;
+  return rest;
+};
 /**
  * User
  */
@@ -33,22 +51,7 @@ class User {
         : o.reset_password_expiry || null;
     this.role_id = o.role_id ? +o.role_id : 8;
 
-    const {
-      email,
-      password,
-      language,
-      _attributes,
-      api_token,
-      verification_token,
-      verified_on,
-      disabled,
-      id,
-      reset_password_token,
-      reset_password_expiry,
-      role_id,
-      ...rest
-    } = o;
-    Object.assign(this, rest);
+    Object.assign(this, safeUserFields(o));
 
     contract.class(this);
   }
@@ -149,13 +152,15 @@ class User {
    * @returns {{role_id: number, language, id, email, tenant: *}}
    */
   get session_object() {
-    return {
+    const so = {
       email: this.email,
       id: this.id,
       role_id: this.role_id,
       language: this.language,
       tenant: db.getTenantSchema(),
     };
+    Object.assign(so, safeUserFields(this));
+    return so;
   }
 
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saltcorn/data",
-  "version": "0.5.5-beta.1",
+  "version": "0.5.6-beta.2",
   "description": "Data models for Saltcorn, open-source no-code platform",
   "homepage": "https://saltcorn.com",
   "scripts": {
@@ -10,7 +10,7 @@
   "license": "MIT",
   "main": "index.js",
   "dependencies": {
-    "@saltcorn/markup": "0.5.5-beta.1",
+    "@saltcorn/markup": "0.5.6-beta.2",
     "acorn": "^8.0.3",
     "adm-zip": "0.5.5",
     "astring": "^1.4.3",
@@ -30,7 +30,7 @@
     "latest-version": "^5.1.0",
     "moment": "^2.27.0",
     "moment-timezone": "^0.5.33",
-    "node-fetch": "^2.6.1",
+    "node-fetch": "2.6.2",
     "nodemailer": "^6.4.17",
     "pg": "^8.2.1",
     "pg-copy-streams": "^5.1.1",

package/plugin-helper.js

@@ -891,7 +891,7 @@ const stateFieldsToWhere = contract(
         if (kpath.length === 3) {
           const [jtNm, jFieldNm, lblField] = kpath;
           qstate.id = [
-            ...(qstate.id || []),
+            ...(qstate.id ? [qstate.id] : []),
             {
               // where id in (select jFieldNm from jtnm where lblField=v)
               inSelect: {

package/tests/table.test.js

@@ -882,6 +882,42 @@ describe("Table with row ownership", () => {
     await persons.delete();
   });
 });
+describe("Table with row ownership", () => {
+  it("should create and delete table", async () => {
+    const persons = await Table.create("TableOwnedFml");
+    const name = await Field.create({
+      table: persons,
+      name: "name",
+      type: "String",
+    });
+    const age = await Field.create({
+      table: persons,
+      name: "age",
+      type: "String",
+    });
+    const owner = await Field.create({
+      table: persons,
+      name: "owner",
+      type: "Key to users",
+    });
+    await persons.update({ ownership_formula: "user.id===owner" });
+    if (!db.isSQLite) {
+      await age.update({ type: "Integer" });
+      await name.update({ name: "lastname" });
+      await persons.insertRow({ lastname: "Joe", age: 12 });
+      await persons.insertRow({ lastname: "Sam", age: 13, owner: 1 });
+      const row = await persons.getRow({ age: 12 });
+      expect(row.lastname).toBe("Joe");
+      expect(row.age).toBe(12);
+      const is_owner = await persons.is_owner({ id: 6 }, row);
+      expect(is_owner).toBe(false);
+      const row1 = await persons.getRow({ age: 13 });
+      const is_owner1 = await persons.is_owner({ id: 1 }, row1);
+      expect(is_owner1).toBe(true);
+    }
+    await persons.delete();
+  });
+});
 describe("Table with UUID pks", () => {
   if (!db.isSQLite) {
     it("should select uuid", async () => {