@saltcorn/data 1.6.0-alpha.9 → 1.6.0-beta.2

package/dist/models/table.js

@@ -202,6 +202,14 @@ class Table {
         this.provider_name = o.provider_name;
         this.fields = o.fields.map((f) => new field_1.default(f));
     }
+    static subClass({ user, read_only, } = {}) {
+        var _a;
+        return _a = class extends this {
+            },
+            _a.fixed_user = user || undefined,
+            _a.read_only = !!read_only,
+            _a;
+    }
     get to_json() {
         return {
             name: this.name,
@@ -263,9 +271,9 @@ class Table {
             return where;
         // todo add string & number as possible types for where
         if (typeof where === "string")
-            return Table.findOne({ name: where });
+            return this.findOne({ name: where });
         if (typeof where === "number")
-            return Table.findOne({ id: where });
+            return this.findOne({ id: where });
         if (typeof where === "undefined")
             return null;
         if (where === null)
@@ -283,10 +291,10 @@ class Table {
                 ? (v) => v.name === where.name
                 : satisfies(where));
         if (tbl?.provider_name) {
-            return new Table(structuredClone(tbl)).to_provided_table();
+            return new this(structuredClone(tbl)).to_provided_table();
         }
         else
-            return tbl ? new Table(structuredClone(tbl)) : null;
+            return tbl ? new this(structuredClone(tbl)) : null;
     }
     /**
      * Find Tables
@@ -298,7 +306,7 @@ class Table {
         if (selectopts.cached) {
             const { getState } = require("../db/state");
             return getState()
-                .tables.map((t) => new Table(structuredClone(t)))
+                .tables.map((t) => new this(structuredClone(t)))
                 .filter(satisfies(where || {}));
         }
         if (where?.name) {
@@ -327,7 +335,7 @@ class Table {
             t.constraints = constraints
                 .filter((f) => f.table_id === t.id)
                 .map((f) => new _TableConstraint(f));
-            const tbl = new Table(t);
+            const tbl = new this(t);
             return tbl.to_provided_table();
         });
     }
@@ -355,7 +363,7 @@ class Table {
                 t.fields = flds
                     .filter((f) => f.table_id === t.id)
                     .map((f) => new field_1.default(f));
-                return new Table(t);
+                return new this(t);
             });
         }
         return [...dbs, ...externals];
@@ -401,18 +409,19 @@ class Table {
      * @returns {boolean}
      */
     is_owner(user, row) {
-        if (!user)
+        let use_user = this.constructor.fixed_user || user;
+        if (!use_user)
             return false;
         if (this.ownership_formula && this.fields) {
             const f = get_expression_function(this.ownership_formula, this.fields);
-            return !!f(row, user);
+            return !!f(row, use_user);
         }
         const field_name = this.owner_fieldname();
         // users are owners of their own row in users table
         if (this.name === "users" && !field_name)
-            return !!user.id && `${row?.id}` === `${user.id}`;
+            return !!use_user.id && `${row?.id}` === `${use_user.id}`;
         return (typeof field_name === "string" &&
-            (row[field_name] === user.id || row[field_name]?.id === user.id));
+            (row[field_name] === use_user.id || row[field_name]?.id === use_user.id));
     }
     /**
      * get Ownership options
@@ -553,6 +562,8 @@ class Table {
         if (pk_type !== "Integer") {
             const { getState } = require("../db/state");
             const type = getState().types[pk_type];
+            if (!type)
+                throw new Error(`Cannot find primary key type ${pk_type} in fields ${JSON.stringify(fields)}`);
             pk_sql_type = type.sql_name;
             if (type.primaryKey?.default_sql)
                 pk_sql_type = `${type.sql_name} default ${type.primaryKey?.default_sql}`;
@@ -568,7 +579,11 @@ class Table {
      */
     static async create(name, options = {}, //TODO not selectoptions
     id) {
-        const { pk_type, pk_sql_type } = Table.pkSqlType(options.fields);
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
+        const { pk_type, pk_sql_type } = options.provider_name
+            ? {}
+            : Table.pkSqlType(options.fields);
         const schema = db_1.default.getTenantSchemaPrefix();
         // create table in database
         if (!options.provider_name)
@@ -645,6 +660,8 @@ class Table {
      * @param table
      */
     static async createInDb(table) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const is_sqlite = db_1.default.isSQLite;
         const schema = db_1.default.getTenantSchemaPrefix();
         const { pk_sql_type } = Table.pkSqlType(table.fields);
@@ -676,6 +693,8 @@ class Table {
      */
     // tbd check all other tables related to table description
     async delete(only_forget = false) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const schema = db_1.default.getTenantSchemaPrefix();
         const is_sqlite = db_1.default.isSQLite;
         await this.update({ ownership_field_id: null });
@@ -708,6 +727,8 @@ class Table {
      * Reset Sequence
      */
     async resetSequence() {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const fields = this.fields;
         const pk = fields.find((f) => f.primary_key);
         if (!pk) {
@@ -726,13 +747,14 @@ class Table {
      * @param forRead
      */
     updateWhereWithOwnership(where, user, forRead) {
-        const role = user?.role_id;
+        let use_user = this.constructor.fixed_user || user;
+        const role = use_user?.role_id;
         const min_role = forRead ? this.min_role_read : this.min_role_write;
         if (role &&
             role > min_role &&
             ((!this.ownership_field_id && !this.ownership_formula) || role === 100))
             return { notAuthorized: true };
-        if (user &&
+        if (use_user &&
             role &&
             role < 100 &&
             role > min_role &&
@@ -741,16 +763,16 @@ class Table {
             if (!owner_field)
                 throw new Error(`Owner field in table ${this.name} not found`);
             mergeIntoWhere(where, {
-                [owner_field.name]: user.id,
+                [owner_field.name]: use_user.id,
             });
         }
-        else if (user &&
+        else if (use_user &&
             role &&
             role < 100 &&
             role > min_role &&
             this.ownership_formula) {
             try {
-                mergeIntoWhere(where, this.ownership_formula_where(user));
+                mergeIntoWhere(where, this.ownership_formula_where(use_user));
             }
             catch (e) {
                 //ignore, ownership formula is too difficult to merge with where
@@ -759,6 +781,8 @@ class Table {
         }
     }
     async addDeleteSyncInfo(ids, timestamp) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         await db_1.default.tryCatchInTransaction(async () => {
             if (ids.length > 0) {
                 const schema = db_1.default.getTenantSchemaPrefix();
@@ -797,9 +821,12 @@ class Table {
      * @returns
      */
     async deleteRows(where, user, noTrigger, resultCollector) {
+        let use_user = this.constructor.fixed_user || user;
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         //Fast truncate if user is admin and where is blank
         const cfields = await field_1.default.find({ reftable_name: this.name }, { cached: true });
-        if ((!user || user?.role_id === 1) &&
+        if ((!use_user || use_user?.role_id === 1) &&
             Object.keys(where).length == 0 &&
             db_1.default.truncate &&
             noTrigger &&
@@ -815,7 +842,7 @@ class Table {
         // get triggers on delete
         const triggers = await trigger_1.default.getTableTriggers("Delete", this);
         const fields = this.fields;
-        if (this.updateWhereWithOwnership(where, user)?.notAuthorized) {
+        if (this.updateWhereWithOwnership(where, use_user)?.notAuthorized) {
             const state = require("../db/state").getState();
             state.log(4, `Not authorized to deleteRows in table ${this.name}.`);
             return;
@@ -829,11 +856,13 @@ class Table {
         }, { cached: true });
         let rows;
         if (calc_agg_fields.length ||
-            (user && user.role_id > this.min_role_write && this.ownership_formula)) {
+            (use_user &&
+                use_user.role_id > this.min_role_write &&
+                this.ownership_formula)) {
             rows = await this.getJoinedRows({
                 where,
-                forUser: user,
-                forPublic: user?.role_id === 100,
+                forUser: use_user,
+                forPublic: use_user?.role_id === 100,
             });
         }
         const deleteFileFields = fields.filter((f) => f.type === "File" && f.attributes?.also_delete_file);
@@ -843,15 +872,15 @@ class Table {
             if (!rows)
                 rows = await this.getJoinedRows({
                     where,
-                    forUser: user,
-                    forPublic: user?.role_id === 100,
+                    forUser: use_user,
+                    forPublic: use_user?.role_id === 100,
                 });
             for (const trigger of triggers) {
                 for (const row of rows) {
                     // run triggers on delete
-                    if (trigger.haltOnOnlyIf?.(row, user))
+                    if (trigger.haltOnOnlyIf?.(row, use_user))
                         continue;
-                    const runres = await trigger.run(row, { user });
+                    const runres = await trigger.run(row, { user: use_user });
                     if (runres && resultCollector)
                         mergeActionResults(resultCollector, runres);
                 }
@@ -932,7 +961,7 @@ class Table {
         if (this.fields) {
             for (const f of this.fields) {
                 if (f.type && (0, common_types_1.instanceOfType)(f.type) && f.type.readFromDB)
-                    row[f.name] = f.type.readFromDB(row[f.name]);
+                    row[f.name] = f.type.readFromDB(row[f.name], f);
             }
         }
         return row;
@@ -972,7 +1001,8 @@ class Table {
     async getRow(where = {}, selopts = {}) {
         const fields = this.fields;
         const { forUser, forPublic, ...selopts1 } = selopts;
-        const role = forUser ? forUser.role_id : forPublic ? 100 : null;
+        const use_forUser = this.constructor.fixed_user || forUser;
+        const role = use_forUser ? use_forUser.role_id : forPublic ? 100 : null;
         this.normalise_fkey_values(where);
         const row = await db_1.default.selectMaybeOne(this.name, where, this.processSelectOptions(selopts1));
         if (!row || !this.fields)
@@ -985,11 +1015,11 @@ class Table {
                 const owner_field = fields.find((f) => f.id === this.ownership_field_id);
                 if (!owner_field)
                     throw new Error(`Owner field in table ${this.name} not found`);
-                if (row[owner_field.name] !== forUser.id)
+                if (row[owner_field.name] !== use_forUser.id)
                     return null;
             }
             else if (this.ownership_formula || this.name === "users") {
-                if (!this.is_owner(forUser, row))
+                if (!this.is_owner(use_forUser, row))
                     return null;
             }
             else
@@ -1027,10 +1057,10 @@ class Table {
         if (!this.fields)
             return [];
         const { forUser, forPublic, ...selopts1 } = selopts;
-        const role = forUser ? forUser.role_id : forPublic ? 100 : null;
+        const use_forUser = this.constructor.fixed_user || forUser;
+        const role = use_forUser ? use_forUser.role_id : forPublic ? 100 : null;
         if (role &&
-            this.updateWhereWithOwnership(where, forUser || { role_id: 100 }, true)
-                ?.notAuthorized) {
+            this.updateWhereWithOwnership(where, use_forUser || { role_id: 100 }, true)?.notAuthorized) {
             return [];
         }
         this.normalise_fkey_values(where);
@@ -1043,7 +1073,8 @@ class Table {
                 //already dealt with by changing where
             }
             else if (this.ownership_formula || this.name === "users") {
-                rows = rows.filter((row) => this.is_owner(forUser, row));
+                if (!selopts?.disable_ownership_postqfilter)
+                    rows = rows.filter((row) => this.is_owner(use_forUser, row));
             }
             else
                 return []; //no ownership
@@ -1155,6 +1186,9 @@ class Table {
      * @returns
      */
     async updateRow(v_in, id_in, user, noTrigger, resultCollector, restore_of_version, syncTimestamp, additionalTriggerValues, autoRecalcIterations, extraArgs) {
+        let use_user = this.constructor.fixed_user || user;
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         // migrating to options arg
         if (typeof noTrigger === "object") {
             const extraOptions = noTrigger;
@@ -1188,7 +1222,7 @@ class Table {
         ]);
         const fields = this.fields;
         const pk_name = this.pk_name;
-        const role = user?.role_id;
+        const role = use_user?.role_id;
         const state = require("../db/state").getState();
         let stringified = false;
         const sqliteJsonCols = !isNode()
@@ -1206,7 +1240,7 @@ class Table {
         }
         if (this.ownership_formula)
             add_free_variables_to_joinfields(freeVariables(this.ownership_formula), joinFields, fields);
-        if (user &&
+        if (use_user &&
             role &&
             (role > this.min_role_write || role > this.min_role_read)) {
             if (role === 100)
@@ -1215,19 +1249,19 @@ class Table {
                 const owner_field = fields.find((f) => f.id === this.ownership_field_id);
                 if (!owner_field)
                     throw new Error(`Owner field in table ${this.name} not found`);
-                if (v[owner_field.name] && v[owner_field.name] != user.id) {
-                    state.log(4, `Not authorized to updateRow in table ${this.name}. ${user.id} does not match owner field in updates`);
+                if (v[owner_field.name] && v[owner_field.name] != use_user.id) {
+                    state.log(4, `Not authorized to updateRow in table ${this.name}. ${use_user.id} does not match owner field in updates`);
                     return "Not authorized";
                 }
                 //need to check existing
                 if (!existing)
                     existing = await this.getJoinedRow({
                         where: { [pk_name]: id },
-                        forUser: user,
+                        forUser: use_user,
                         joinFields,
                     });
-                if (!existing || existing?.[owner_field.name] !== user.id) {
-                    state.log(4, `Not authorized to updateRow in table ${this.name}. ${user.id} does not match owner field in exisiting`);
+                if (!existing || existing?.[owner_field.name] !== use_user.id) {
+                    state.log(4, `Not authorized to updateRow in table ${this.name}. ${use_user.id} does not match owner field in exisiting`);
                     return "Not authorized";
                 }
             }
@@ -1235,11 +1269,11 @@ class Table {
                 if (!existing)
                     existing = await this.getJoinedRow({
                         where: { [pk_name]: id },
-                        forUser: user,
+                        forUser: use_user,
                         joinFields,
                     });
-                if (!existing || !this.is_owner(user, existing)) {
-                    state.log(4, `Not authorized to updateRow in table ${this.name}. User does not match formula: ${JSON.stringify(user)}`);
+                if (!existing || !this.is_owner(use_user, existing)) {
+                    state.log(4, `Not authorized to updateRow in table ${this.name}. User does not match formula: ${JSON.stringify(use_user)}`);
                     return "Not authorized";
                 }
             }
@@ -1252,7 +1286,7 @@ class Table {
             if (!existing)
                 existing = await this.getJoinedRow({
                     where: { [pk_name]: id },
-                    forUser: user,
+                    forUser: use_user,
                     joinFields,
                 });
             const newRow = { ...existing, ...v };
@@ -1260,8 +1294,8 @@ class Table {
             if (constraint_check)
                 return constraint_check;
         }
-        if (user) {
-            let field_write_check = this.check_field_write_role(v, user);
+        if (use_user) {
+            let field_write_check = this.check_field_write_role(v, use_user);
             if (field_write_check)
                 return field_write_check;
         }
@@ -1270,11 +1304,11 @@ class Table {
             if (!existing)
                 existing = await this.getJoinedRow({
                     where: { [pk_name]: id },
-                    forUser: user,
+                    forUser: use_user,
                     joinFields,
                 });
             const valResCollector = resultCollector || {};
-            await trigger_1.default.runTableTriggers("Validate", this, { ...(additionalTriggerValues || {}), ...existing, ...v }, valResCollector, user, { old_row: existing, updated_fields: v_in, ...(extraArgs || {}) });
+            await trigger_1.default.runTableTriggers("Validate", this, { ...(additionalTriggerValues || {}), ...existing, ...v }, valResCollector, use_user, { old_row: existing, updated_fields: v_in, ...(extraArgs || {}) });
             if ("error" in valResCollector)
                 return valResCollector.error;
             if ("set_fields" in valResCollector)
@@ -1286,7 +1320,7 @@ class Table {
             let need_to_update = Object.keys(v_in).some((k) => freeVarFKFields.has(k));
             existing = await this.getJoinedRow({
                 where: { [pk_name]: id },
-                forUser: user,
+                forUser: use_user,
                 joinFields,
             });
             let updated;
@@ -1300,7 +1334,7 @@ class Table {
                 });
                 updated = await this.getJoinedRow({
                     where: { [pk_name]: id },
-                    forUser: user,
+                    forUser: use_user,
                     joinFields,
                 });
             }
@@ -1334,7 +1368,7 @@ class Table {
                         pk_name,
                     },
                     _time: new Date(),
-                    _userid: user?.id,
+                    _userid: use_user?.id,
                     _restore_of_version: restore_of_version || null,
                 });
         }
@@ -1343,7 +1377,7 @@ class Table {
             if (triggers.length > 0)
                 existing = await this.getJoinedRow({
                     where: { [pk_name]: id },
-                    forUser: user,
+                    forUser: use_user,
                     joinFields,
                 });
         }
@@ -1364,7 +1398,7 @@ class Table {
         if (!existing && really_changed_field_names.size && keyChanged)
             existing = await this.getJoinedRow({
                 where: { [pk_name]: id },
-                forUser: user,
+                forUser: use_user,
                 joinFields,
             });
         await db_1.default.update(this.name, v, id, {
@@ -1387,10 +1421,12 @@ class Table {
                 await this.auto_update_calc_aggregations(existing, !existing, (autoRecalcIterations || 0) + 1, really_changed_field_names, keyChanged);
         }
         if (!noTrigger) {
-            await trigger_1.default.runTableTriggers("Update", this, { ...(additionalTriggerValues || {}), ...newRow }, resultCollector, role === 100 ? undefined : user, { old_row: existing, updated_fields: v_in, ...(extraArgs || {}) });
+            await trigger_1.default.runTableTriggers("Update", this, { ...(additionalTriggerValues || {}), ...newRow }, resultCollector, role === 100 ? undefined : use_user, { old_row: existing, updated_fields: v_in, ...(extraArgs || {}) });
         }
     }
     static async analyze_all_indexed_tables() {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const tables = await Table.find({}, { cached: true });
         const schemaPrefix = db_1.default.getTenantSchemaPrefix();
         for (const table of tables)
@@ -1398,6 +1434,8 @@ class Table {
                 await db_1.default.query(`analyze ${schemaPrefix}"${(0, internal_1.sqlsanitize)(table.name)}";`);
     }
     async insert_history_row(v0, retry = 0) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         // sometimes there is a race condition in history inserts
         // https://dba.stackexchange.com/questions/212580/concurrent-transactions-result-in-race-condition-with-unique-constraint-on-inser
         // solution: retry 3 times, if fails run with on conflict do nothing
@@ -1452,6 +1490,8 @@ class Table {
         });
     }
     async insertSyncInfo(id, updates, syncTimestamp) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         await db_1.default.tryCatchInTransaction(async () => {
             const schema = db_1.default.getTenantSchemaPrefix();
             if (isNode()) {
@@ -1479,6 +1519,8 @@ class Table {
         });
     }
     async updateSyncInfo(id, v, oldLastModified, syncTimestamp) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         await db_1.default.tryCatchInTransaction(async () => {
             const schema = db_1.default.getTenantSchemaPrefix();
             if (!db_1.default.isSQLite) {
@@ -1521,8 +1563,11 @@ class Table {
      * @returns {Promise<{error}|{success: boolean}>}
      */
     async tryUpdateRow(v, id, user, resultCollector, extraArgs) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
+        let use_user = this.constructor.fixed_user || user;
         try {
-            const maybe_err = await this.updateRow(v, id, user, {
+            const maybe_err = await this.updateRow(v, id, use_user, {
                 noTrigger: false,
                 resultCollector,
                 extraArgs,
@@ -1543,9 +1588,12 @@ class Table {
      * @returns {Promise<void>}
      */
     async toggleBool(id, field_name, user) {
+        let use_user = this.constructor.fixed_user || user;
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const row = await this.getRow({ [this.pk_name]: id });
         if (row)
-            await this.updateRow({ [field_name]: !row[field_name] }, id, user);
+            await this.updateRow({ [field_name]: !row[field_name] }, id, use_user);
     }
     delete_url(row, moreQuery) {
         const comppk = this.composite_pk_names;
@@ -1608,10 +1656,11 @@ class Table {
      * @param user
      */
     check_field_write_role(row, user) {
+        let use_user = this.constructor.fixed_user || user;
         for (const field of this.fields) {
             if (typeof row[field.name] !== "undefined" &&
                 field.attributes?.min_role_write &&
-                user.role_id > +field.attributes?.min_role_write)
+                use_user.role_id > +field.attributes?.min_role_write)
                 return "Not authorized";
         }
         return undefined;
@@ -1627,6 +1676,15 @@ class Table {
                     v_in[field.name] = v_in[field.name][pk];
             }
     }
+    async run_trigger(trigger_name, row, user, extraArgs) {
+        let use_user = this.constructor.fixed_user || user;
+        const trigger = trigger_1.default.findOne({ name: trigger_name });
+        return await trigger.runWithoutRow({
+            row,
+            user: use_user,
+            ...(extraArgs || {}),
+        });
+    }
     /**
      * Insert row into the table. By passing in the user as
      * the second argument, it will check write rights. If a user object is not
@@ -1651,6 +1709,9 @@ class Table {
      * @returns
      */
     async insertRow(v_in0, user, resultCollector, noTrigger, syncTimestamp) {
+        let use_user = this.constructor.fixed_user || user;
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const v_in = { ...v_in0 };
         const fields = this.fields;
         const pk_name = this.pk_name;
@@ -1667,13 +1728,13 @@ class Table {
             }
             : {};
         this.normalise_fkey_values(v_in);
-        if (user && user.role_id > this.min_role_write) {
+        if (use_user && use_user.role_id > this.min_role_write) {
             if (this.ownership_field_id) {
                 const owner_field = fields.find((f) => f.id === this.ownership_field_id);
                 if (!owner_field)
                     throw new Error(`Owner field in table ${this.name} not found`);
-                if (v_in[owner_field.name] != user.id) {
-                    state.log(4, `Not authorized to insertRow in table ${this.name}. ${user.id} does not match owner field`);
+                if (v_in[owner_field.name] != use_user.id) {
+                    state.log(4, `Not authorized to insertRow in table ${this.name}. ${use_user.id} does not match owner field`);
                     return;
                 }
             }
@@ -1685,14 +1746,14 @@ class Table {
         let constraint_check = this.check_table_constraints(v_in);
         if (constraint_check)
             throw new Error(constraint_check);
-        if (user) {
-            let field_write_check = this.check_field_write_role(v_in, user);
+        if (use_user) {
+            let field_write_check = this.check_field_write_role(v_in, use_user);
             if (field_write_check)
                 return field_write_check;
         }
         //check validate here based on v_in
         const valResCollector = resultCollector || {};
-        await trigger_1.default.runTableTriggers("Validate", this, { ...v_in }, valResCollector, user);
+        await trigger_1.default.runTableTriggers("Validate", this, { ...v_in }, valResCollector, use_user);
         if ("error" in valResCollector)
             return valResCollector; //???
         if ("set_fields" in valResCollector)
@@ -1705,7 +1766,7 @@ class Table {
             let existing = await this.getJoinedRows({
                 where: { [pk_name]: id },
                 joinFields,
-                forUser: user,
+                forUser: use_user,
             });
             if (!existing?.[0]) {
                 //failed ownership test
@@ -1731,15 +1792,17 @@ class Table {
                 ...sqliteJsonCols,
             });
         }
-        if (user && user.role_id > this.min_role_write && this.ownership_formula) {
+        if (use_user &&
+            use_user.role_id > this.min_role_write &&
+            this.ownership_formula) {
             let existing = await this.getJoinedRow({
                 where: { [pk_name]: id },
                 joinFields,
-                forUser: user,
+                forUser: use_user,
             });
-            if (!existing || !this.is_owner(user, existing)) {
+            if (!existing || !this.is_owner(use_user, existing)) {
                 await this.deleteRows({ [pk_name]: id });
-                state.log(4, `Not authorized to insertRow in table ${this.name}. User does not match formula: ${JSON.stringify(user)}`);
+                state.log(4, `Not authorized to insertRow in table ${this.name}. User does not match formula: ${JSON.stringify(use_user)}`);
                 return;
             }
         }
@@ -1751,7 +1814,7 @@ class Table {
                     next_version_by_id: id,
                     pk_name,
                 },
-                _userid: user?.id,
+                _userid: use_user?.id,
                 _time: new Date(),
             });
         if (this.has_sync_info) {
@@ -1779,11 +1842,13 @@ class Table {
         await this.auto_update_calc_aggregations(newRow);
         if (!noTrigger) {
             apply_calculated_fields([newRow], this.fields);
-            await trigger_1.default.runTableTriggers("Insert", this, newRow, resultCollector, user);
+            await trigger_1.default.runTableTriggers("Insert", this, newRow, resultCollector, use_user);
         }
         return id;
     }
     async auto_update_calc_aggregations(v0, refetch, iterations = 1, changedFields, keyChanged = false) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const state = require("../db/state").getState();
         const pk_name = this.pk_name;
         state.log(6, `auto_update_calc_aggregations table=${this.name} id=${v0[pk_name]} iters=${iterations}${changedFields ? ` changedFields=${[...(changedFields || [])]}` : ""}`);
@@ -1915,8 +1980,11 @@ class Table {
      * @returns {Promise<{error}|{success: *}>}
      */
     async tryInsertRow(v, user, resultCollector) {
+        let use_user = this.constructor.fixed_user || user;
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         try {
-            const id = await this.insertRow(v, user, resultCollector);
+            const id = await this.insertRow(v, use_user, resultCollector);
             if (!id)
                 return { error: "Not authorized" };
             if (id?.includes?.("Not authorized"))
@@ -2064,6 +2132,8 @@ class Table {
           );`);
     }
     async create_sync_info_table() {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         await db_1.default.tryCatchInTransaction(async () => {
             const schemaPrefix = db_1.default.getTenantSchemaPrefix();
             const fields = this.fields;
@@ -2086,6 +2156,8 @@ class Table {
         });
     }
     async drop_sync_table() {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         await db_1.default.tryCatchInTransaction(async () => {
             const schemaPrefix = db_1.default.getTenantSchemaPrefix();
             await db_1.default.query(`
@@ -2103,6 +2175,9 @@ class Table {
      * @param user
      */
     async restore_row_version(id, version, user) {
+        let use_user = this.constructor.fixed_user || user;
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const row = await db_1.default.selectOne(`${db_1.default.sqlsanitize(this.name)}__history`, {
             [this.pk_name]: id,
             _version: version,
@@ -2113,7 +2188,7 @@ class Table {
                 r[f.name] = row[f.name];
         });
         //console.log("restore_row_version", r);
-        await this.updateRow(r, id, user, false, undefined, version);
+        await this.updateRow(r, id, use_user, false, undefined, version);
     }
     /**
      * Undo row chnages
@@ -2121,6 +2196,9 @@ class Table {
      * @param user
      */
     async undo_row_changes(id, user) {
+        let use_user = this.constructor.fixed_user || user;
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const current_version_row = await db_1.default.selectMaybeOne(`${(0, internal_1.sqlsanitize)(this.name)}__history`, { [this.pk_name]: id }, { orderBy: "_version", orderDesc: true, limit: 1 });
         //get max that is not a restore
         const last_non_restore = await db_1.default.selectMaybeOne(`${(0, internal_1.sqlsanitize)(this.name)}__history`, {
@@ -2132,7 +2210,7 @@ class Table {
             },
         }, { orderBy: "_version", orderDesc: true, limit: 1 });
         if (last_non_restore) {
-            await this.restore_row_version(id, last_non_restore._version, user);
+            await this.restore_row_version(id, last_non_restore._version, use_user);
         }
     }
     /**
@@ -2141,6 +2219,9 @@ class Table {
      * @param user
      */
     async redo_row_changes(id, user) {
+        let use_user = this.constructor.fixed_user || user;
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const current_version_row = await db_1.default.selectMaybeOne(`${(0, internal_1.sqlsanitize)(this.name)}__history`, { [this.pk_name]: id }, { orderBy: "_version", orderDesc: true, limit: 1 });
         if (current_version_row._restore_of_version) {
             const next_version = await db_1.default.selectMaybeOne(`${(0, internal_1.sqlsanitize)(this.name)}__history`, {
@@ -2150,7 +2231,7 @@ class Table {
                 },
             }, { orderBy: "_version", limit: 1 });
             if (next_version) {
-                await this.restore_row_version(id, next_version._version, user);
+                await this.restore_row_version(id, next_version._version, use_user);
             }
         }
     }
@@ -2159,6 +2240,8 @@ class Table {
      * with options object, or just minimal interval for legacy code
      */
     async compress_history(options) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const interval_secs = typeof options === "number" ? options : options?.interval_secs;
         const schemaPrefix = db_1.default.getTenantSchemaPrefix();
         const pk = this.pk_name;
@@ -2205,6 +2288,8 @@ class Table {
      */
     async drop_history_table() {
         const schemaPrefix = db_1.default.getTenantSchemaPrefix();
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         await db_1.default.query(`
       drop table ${schemaPrefix}"${(0, internal_1.sqlsanitize)(this.name)}__history";`);
     }
@@ -2214,6 +2299,8 @@ class Table {
      * @returns {Promise<void>}
      */
     async rename(new_name) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         //in transaction
         if (db_1.default.isSQLite)
             throw new InvalidAdminAction("Cannot rename table on SQLite");
@@ -2238,6 +2325,8 @@ class Table {
      * @returns {Promise<void>}
      */
     async update(new_table_rec) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         if (new_table_rec.ownership_field_id === "")
             delete new_table_rec.ownership_field_id;
         const existing = Table.findOne({ id: this.id });
@@ -2290,6 +2379,8 @@ class Table {
      * @returns {Promise<void>}
      */
     async enable_fkey_constraints() {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const fields = this.fields;
         for (const f of fields)
             await f.enable_fkey_constraint(this);
@@ -2301,6 +2392,8 @@ class Table {
      * @returns {Promise<{error: string}|{error: string}|{error: string}|{error: string}|{error: string}|{success: string}|{error: (string|string|*)}>}
      */
     static async create_from_csv(name, filePath) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         let rows;
         const state = await require("../db/state").getState();
         try {
@@ -2472,6 +2565,9 @@ class Table {
      * @returns {Promise<{error: string}|{success: string}>}
      */
     async import_csv_file(filePath, options) {
+        //todo user check
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         if (typeof options === "boolean") {
             options = { recalc_stored: options };
         }
@@ -2556,6 +2652,10 @@ class Table {
         // start sql transaction
         if (!options?.no_transaction)
             await client.query("BEGIN");
+        if (db_1.default.isSQLite)
+            await client.query("PRAGMA defer_foreign_keys = ON");
+        else
+            await client.query("SET CONSTRAINTS ALL DEFERRED");
         const readStream = (0, fs_1.createReadStream)(filePath);
         const returnedRows = [];
         try {
@@ -2801,6 +2901,8 @@ ${rejectDetails}`,
         return v1;
     }
     async import_json_history_file(filePath) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         return await (0, async_json_stream_1.default)(filePath, async (row) => {
             await this.insert_history_row(row);
         });
@@ -2812,6 +2914,8 @@ ${rejectDetails}`,
      * @returns {Promise<{error: string}|{success: string}>}
      */
     async import_json_file(filePath, skip_first_data_row) {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const fields = this.fields;
         const pk_name = this.pk_name;
         const { readState } = require("../plugin-helper");
@@ -3087,10 +3191,10 @@ ${rejectDetails}`,
     async aggregationQuery(aggregations, options) {
         const { forUser, forPublic } = options || {};
         const role = forUser ? forUser.role_id : forPublic ? 100 : null;
+        const use_forUser = this.constructor.fixed_user || forUser;
         const where = { ...(options?.where || {}) };
         if (role &&
-            this.updateWhereWithOwnership(where, forUser || { role_id: 100 }, true)
-                ?.notAuthorized) {
+            this.updateWhereWithOwnership(where, use_forUser || { role_id: 100 }, true)?.notAuthorized) {
             const emptyRet = {};
             Object.entries(aggregations).forEach(([nm, aggObj]) => {
                 const agg = aggObj?.aggregate?.toLowerCase?.() || "count";
@@ -3114,9 +3218,10 @@ ${rejectDetails}`,
         return res.rows[0];
     }
     ownership_formula_where(user) {
+        let use_user = this.constructor.fixed_user || user;
         if (!this.ownership_formula)
             return {};
-        const wh = jsexprToWhere(this.ownership_formula, { user }, this.fields);
+        const wh = jsexprToWhere(this.ownership_formula, { user: use_user }, this.fields);
         if (wh.eq && Array.isArray(wh.eq)) {
             let arr = wh.eq;
             for (let index = 0; index < arr.length; index++) {
@@ -3152,7 +3257,8 @@ ${rejectDetails}`,
             ? `"${opts.schema}".`
             : db_1.default.getTenantSchemaPrefix();
         const { forUser, forPublic } = opts;
-        const role = forUser ? forUser.role_id : forPublic ? 100 : null;
+        const use_forUser = this.constructor.fixed_user || forUser;
+        const role = use_forUser ? use_forUser.role_id : forPublic ? 100 : null;
         if (role && role > this.min_role_read && this.ownership_formula) {
             const freeVars = freeVariables(this.ownership_formula);
             add_free_variables_to_joinfields(freeVars, joinFields, fields);
@@ -3166,17 +3272,17 @@ ${rejectDetails}`,
             if (!owner_field)
                 throw new Error(`Owner field in table ${this.name} not found`);
             mergeIntoWhere(opts.where, {
-                [owner_field.name]: forUser.id,
+                [owner_field.name]: use_forUser.id,
             });
         }
-        else if (forUser &&
+        else if (use_forUser &&
             role &&
             role > this.min_role_read &&
             this.ownership_formula) {
             if (forPublic || role === 100)
                 return { notAuthorized: true }; //TODO may not be true
             try {
-                mergeIntoWhere(opts.where, this.ownership_formula_where(forUser));
+                mergeIntoWhere(opts.where, this.ownership_formula_where(use_forUser));
             }
             catch (e) {
                 //ignore, ownership formula is too difficult to merge with where
@@ -3353,7 +3459,8 @@ ${rejectDetails}`,
     async getJoinedRows(opts = {}) {
         const fields = this.fields;
         const { forUser, forPublic, ...selopts1 } = opts;
-        const role = forUser ? forUser.role_id : forPublic ? 100 : null;
+        const use_forUser = this.constructor.fixed_user || forUser;
+        const role = use_forUser ? use_forUser.role_id : forPublic ? 100 : null;
         const { sql, values, notAuthorized, joinFields, aggregations } = await this.getJoinedQuery(opts);
         if (notAuthorized)
             return [];
@@ -3394,7 +3501,7 @@ ${rejectDetails}`,
                 //already dealt with by changing where
             }
             else if (this.ownership_formula || this.name === "users") {
-                calcRow = calcRow.filter((row) => this.is_owner(forUser, row));
+                calcRow = calcRow.filter((row) => this.is_owner(use_forUser, row));
             }
             else
                 return []; //no ownership
@@ -3466,6 +3573,8 @@ ${rejectDetails}`,
         return (0, table_helper_1.get_formula_examples)(typename, this.fields.filter((f) => !f.calculated));
     }
     async repairCompositePrimary() {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const primaryKeys = this.fields.filter((f) => f.primary_key);
         const nonSerialPKS = primaryKeys.some((f) => f.attributes?.NonSerial);
         const schemaPrefix = db_1.default.getTenantSchemaPrefix();
@@ -3507,6 +3616,8 @@ where table_schema = '${db_1.default.getTenantSchema() || "public"}'
             await Table.state_refresh(true);
     }
     async move_include_fts_to_search_context() {
+        if (this.constructor.read_only)
+            throw new Error("Read-only access");
         const include_fts_fields = this.fields.filter((f) => f.attributes?.include_fts);
         if (!include_fts_fields.length)
             return;
@@ -3543,6 +3654,8 @@ where table_schema = '${db_1.default.getTenantSchema() || "public"}'
             }
     }
 }
+Table.fixed_user = undefined;
+Table.read_only = false;
 async function dump_table_to_json_file(filePath, tableName) {
     const writeStream = (0, fs_1.createWriteStream)(filePath);
     const client = db_1.default.isSQLite ? db_1.default : await db_1.default.getClient();