@saltcorn/server 0.8.0-beta.3 → 0.8.0

package/auth/index.js

@@ -1,20 +1,20 @@
-// for the jsdoc documentation
-/**
- *
- * @category server
- * @module auth/index
- * @subcategory auth
- */
-
-/**
- * All files in the auth module.
- * @namespace auth_overview
- * @property {module:auth/admin} admin
- * @property {module:auth/resetpw} resetpw
- * @property {module:auth/roleadmin} roleadmin
- * @property {module:auth/routes} routes
- * @property {module:auth/testhelp} testhelp
- * 
- * @category server
- * @subcategory auth
- */
+// for the jsdoc documentation
+/**
+ *
+ * @category server
+ * @module auth/index
+ * @subcategory auth
+ */
+
+/**
+ * All files in the auth module.
+ * @namespace auth_overview
+ * @property {module:auth/admin} admin
+ * @property {module:auth/resetpw} resetpw
+ * @property {module:auth/roleadmin} roleadmin
+ * @property {module:auth/routes} routes
+ * @property {module:auth/testhelp} testhelp
+ *
+ * @category server
+ * @subcategory auth
+ */

package/auth/roleadmin.js

@@ -17,15 +17,8 @@ const {
 } = require("@saltcorn/markup");
 const { isAdmin, error_catcher, csrfField } = require("../routes/utils");
 const { getState } = require("@saltcorn/data/db/state");
-const {
-  text,
-  form,
-  option,
-  select,
-} = require("@saltcorn/markup/tags");
-const {
-  send_users_page,
-} = require("../markup/admin");
+const { text, form, option, select } = require("@saltcorn/markup/tags");
+const { send_users_page } = require("../markup/admin");
 
 /**
  * @type {object}

package/auth/routes.js

@@ -52,6 +52,9 @@ const rateLimit = require("express-rate-limit");
 const moment = require("moment");
 const View = require("@saltcorn/data/models/view");
 const Table = require("@saltcorn/data/models/table");
+const {
+  getForm,
+} = require("@saltcorn/data/base-plugin/viewtemplates/viewable_fields");
 const { InvalidConfiguration } = require("@saltcorn/data/utils");
 const Trigger = require("@saltcorn/data/models/trigger");
 const { restore_backup } = require("../markup/admin.js");
@@ -75,6 +78,7 @@ const router = new Router();
 module.exports = router;
 
 /**
+ * Login Form
  * @param {object} req
  * @param {boolean} isCreating
  * @returns {Form}
@@ -100,7 +104,8 @@ const loginForm = (req, isCreating) => {
           input_type: "email",
         },
         sublabel: user_sublabel || undefined,
-        validator: (s) => s.length < 128,
+        // fixed correct size of email is 254 https://stackoverflow.com/questions/386294/what-is-the-maximum-length-of-a-valid-email-address
+        validator: (s) => s.length < 255,
       }),
       new Field({
         label: req.__("Password"),
@@ -117,6 +122,7 @@ const loginForm = (req, isCreating) => {
 };
 
 /**
+ * Forgot Form
  * @param {object} req
  * @returns {Form}
  */
@@ -133,7 +139,8 @@ const forgotForm = (req) =>
         attributes: {
           input_type: "email",
         },
-        validator: (s) => s.length < 128,
+        // fixed correct size of email is 254 https://stackoverflow.com/questions/386294/what-is-the-maximum-length-of-a-valid-email-address
+        validator: (s) => s.length < 255,
       }),
     ],
     action: "/auth/forgot",
@@ -141,6 +148,7 @@ const forgotForm = (req) =>
   });
 
 /**
+ * Reset Form
  * @param {object} body
  * @param {object} req
  * @returns {Form}
@@ -172,6 +180,7 @@ const resetForm = (body, req) => {
 };
 
 /**
+ * get Auth Links
  * @param {string} current
  * @param {boolean} noMethods
  * @returns {object}
@@ -198,7 +207,13 @@ const getAuthLinks = (current, noMethods) => {
     });
   return links;
 };
-
+/**
+ * Login with jwt
+ * @param {*} email
+ * @param {*} password
+ * @param {*} saltcornApp
+ * @param {*} res
+ */
 const loginWithJwt = async (email, password, saltcornApp, res) => {
   const loginFn = async () => {
     const publicUserLink = getState().getConfig("public_user_link");
@@ -263,6 +278,7 @@ const loginWithJwt = async (email, password, saltcornApp, res) => {
 };
 
 /**
+ * GET /auth/login
  * @name get/login
  * @function
  * @memberof module:auth/routes~routesRouter
@@ -290,6 +306,7 @@ router.get(
 );
 
 /**
+ * GET /auth/logout
  * @name get/logout
  * @function
  * @memberof module:auth/routes~routesRouter
@@ -433,6 +450,23 @@ router.post(
   })
 );
 
+const default_signup_form = async (req) => {
+  const form = loginForm(req, true);
+  const new_user_form = getState().getConfig("new_user_form", "");
+  if (!new_user_form) {
+    const userTable = await Table.findOne({ name: "users" });
+    const userFields = await userTable.getFields();
+
+    for (const f of userFields) {
+      if (f.required && !f.calculated && !["id", "email"].includes(f.name))
+        form.fields.push(f);
+    }
+  }
+  form.action = "/auth/signup";
+  form.submitLabel = req.__("Sign up");
+  return form;
+};
+
 /**
  * @name get/signup
  * @function
@@ -447,19 +481,7 @@ router.get(
       return;
     }
     const defaultSignup = async () => {
-      const form = loginForm(req, true);
-      const new_user_form = getState().getConfig("new_user_form", "");
-      if (!new_user_form) {
-        const userTable = await Table.findOne({ name: "users" });
-        const userFields = await userTable.getFields();
-
-        for (const f of userFields) {
-          if (f.required && !f.calculated && !["id", "email"].includes(f.name))
-            form.fields.push(f);
-        }
-      }
-      form.action = "/auth/signup";
-      form.submitLabel = req.__("Sign up");
+      const form = await default_signup_form(req);
       res.sendAuthWrap(req.__(`Sign up`), form, getAuthLinks("signup"));
     };
     const signup_form_name = getState().getConfig("signup_form", "");
@@ -503,11 +525,11 @@ router.get(
         form,
         {},
         restore +
-        script(
-          domReady(
-            `$('form.create-first-user button[type=submit]').click(function(){press_store_button(this)})`
+          script(
+            domReady(
+              `$('form.create-first-user button[type=submit]').click(function(){press_store_button(this)})`
+            )
           )
-        )
       );
     } else {
       req.flash("danger", req.__("Users already present"));
@@ -536,7 +558,7 @@ router.post(
       );
       if (err) req.flash("error", err);
       else req.flash("success", req.__("Successfully restored backup"));
-      fs.unlink(newPath, function () { });
+      fs.unlink(newPath, function () {});
       res.redirect(`/auth/login`);
     } else {
       req.flash("danger", req.__("Users already present"));
@@ -568,18 +590,15 @@ router.post(
       } else {
         const { email, password } = form.values;
         const u = await User.create({ email, password, role_id: 1 });
-        req.login(
-          u.session_object,
-          function (err) {
-            if (!err) {
-              Trigger.emitEvent("Login", null, u);
-              res.redirect("/");
-            } else {
-              req.flash("danger", err);
-              res.redirect("/auth/signup");
-            }
+        req.login(u.session_object, function (err) {
+          if (!err) {
+            Trigger.emitEvent("Login", null, u);
+            res.redirect("/");
+          } else {
+            req.flash("danger", err);
+            res.redirect("/auth/signup");
           }
-        );
+        });
       }
     } else {
       req.flash("danger", req.__("Users already present"));
@@ -673,21 +692,18 @@ const getNewUserForm = async (new_user_view_name, req, askEmail) => {
  * @returns {void}
  */
 const signup_login_with_user = (u, req, res) =>
-  req.login(
-    u.session_object,
-    function (err) {
-      if (!err) {
-        Trigger.emitEvent("Login", null, u);
-        if (getState().verifier) res.redirect("/auth/verification-flow");
-        else if (getState().get2FApolicy(u) === "Mandatory")
-          res.redirect("/auth/twofa/setup/totp");
-        else res.redirect("/");
-      } else {
-        req.flash("danger", err);
-        res.redirect("/auth/signup");
-      }
+  req.login(u.session_object, function (err) {
+    if (!err) {
+      Trigger.emitEvent("Login", null, u);
+      if (getState().verifier) res.redirect("/auth/verification-flow");
+      else if (getState().get2FApolicy(u) === "Mandatory")
+        res.redirect("/auth/twofa/setup/totp");
+      else res.redirect("/");
+    } else {
+      req.flash("danger", err);
+      res.redirect("/auth/signup");
     }
-  );
+  });
 
 /**
  * @name get/signup_final_ext
@@ -717,6 +733,7 @@ router.get(
  */
 router.post(
   "/signup_final_ext",
+  setTenant,
   error_catcher(async (req, res) => {
     const new_user_form = getState().getConfig("new_user_form");
     if (!req.user || req.user.id || !new_user_form) {
@@ -727,7 +744,7 @@ router.post(
     const form = await getNewUserForm(new_user_form, req, !req.user.email);
     form.action = "/auth/signup_final_ext";
 
-    form.validate(req.body);
+    await form.asyncValidate(req.body);
     if (form.hasErrors) {
       res.sendAuthWrap(new_user_form, form, getAuthLinks("signup", true));
       return;
@@ -769,6 +786,7 @@ router.post(
  */
 router.post(
   "/signup_final",
+  setTenant,
   error_catcher(async (req, res) => {
     if (getState().getConfig("allow_signup")) {
       const new_user_form = getState().getConfig("new_user_form");
@@ -787,7 +805,7 @@ router.post(
           });
         }
       }
-      form.validate(req.body);
+      await form.asyncValidate(req.body);
       if (form.hasErrors) {
         res.sendAuthWrap(new_user_form, form, getAuthLinks("signup", true));
       } else if (form.values.email && !check_email_mask(form.values.email)) {
@@ -830,6 +848,7 @@ router.post(
  */
 router.post(
   "/signup",
+  setTenant,
   error_catcher(async (req, res) => {
     if (!getState().getConfig("allow_signup")) {
       req.flash("danger", req.__("Signups not enabled"));
@@ -884,16 +903,33 @@ router.post(
 
     const signup_form_name = getState().getConfig("signup_form", "");
     if (signup_form_name) {
-      const signup_form = await View.findOne({ name: signup_form_name });
-      if (signup_form) {
-        const userObject = {};
-        signup_form.configuration.columns.forEach((col) => {
-          if (col.type === "Field") {
-            if (col.field_name === "passwordRepeat")
-              userObject[col.field_name] = req.body[col.field_name] || "";
-            else userObject[col.field_name] = req.body[col.field_name];
-          }
+      const signup_view = await View.findOne({ name: signup_form_name });
+      if (signup_view) {
+        const signup_form = await getForm(
+          Table.findOne({ name: "users" }),
+          signup_form_name,
+          signup_view.configuration.columns,
+          signup_view.configuration.layout,
+          undefined,
+          req,
+          false
+        );
+        await signup_form.asyncValidate(req.body);
+        if (signup_form.hasErrors) {
+          signup_form.action = "/auth/signup";
+          res.sendAuthWrap(
+            req.__(`Sign up`),
+            signup_form,
+            getAuthLinks("signup")
+          );
+          return;
+        }
+        //ensure pw repeat is set if used.
+        signup_form.fields.forEach((f) => {
+          if (f.name === "passwordRepeat")
+            signup_form.values[f.name] = signup_form.values[f.name] || "";
         });
+        const userObject = signup_form.values;
         const { email, password, passwordRepeat } = userObject;
         if (await unsuitableEmailPassword(email, password, passwordRepeat))
           return;
@@ -914,8 +950,8 @@ router.post(
       }
     }
 
-    const form = loginForm(req, true);
-    form.validate(req.body);
+    const form = await default_signup_form(req);
+    await form.asyncValidate(req.body);
 
     if (form.hasErrors) {
       form.action = "/auth/signup";
@@ -930,7 +966,7 @@ router.post(
         form.values.password = password;
         res.sendAuthWrap(new_user_form, form, getAuthLinks("signup", true));
       } else {
-        const u = await User.create({ email, password });
+        const u = await User.create(form.values);
         await send_verification_email(u, req);
         if (req.smr)
           await loginWithJwt(
@@ -959,7 +995,7 @@ function handler(req, res) {
   req.flash(
     "error",
     "You've made too many failed attempts in a short period of time, please try again " +
-    moment(req.rateLimit.resetTime).fromNow()
+      moment(req.rateLimit.resetTime).fromNow()
   );
   res.redirect("/auth/login"); // brute force protection triggered, send them back to the login page
 }
@@ -992,6 +1028,7 @@ const userLimiter = rateLimit({
 });
 
 /**
+ * POST /auth/login
  * @name post/login
  * @function
  * @memberof module:auth/routes~routesRouter
@@ -1183,7 +1220,10 @@ const setLanguageForm = (req, user) =>
         option(
           {
             value: locale,
-            ...(((user && user.language === locale) || (user && !user.language && req.getLocale() === locale)) && { selected: true }),
+            ...(((user && user.language === locale) ||
+              (user && !user.language && req.getLocale() === locale)) && {
+              selected: true,
+            }),
           },
           language
         )
@@ -1223,7 +1263,7 @@ const userSettings = async ({ req, res, pwform, user }) => {
         div(
           user.api_token
             ? span({ class: "me-1" }, req.__("API token for this user: ")) +
-            code(user.api_token)
+                code(user.api_token)
             : req.__("No API token issued")
         ),
         // button for reset or generate api token
@@ -1237,16 +1277,16 @@ const userSettings = async ({ req, res, pwform, user }) => {
         ),
         // button for remove api token
         user.api_token &&
-        div(
-          { class: "mt-4 ms-2 d-inline-block" },
-          post_btn(
-            `/auth/remove-api-token`,
-            // TBD localization
-            user.api_token ? req.__("Remove") : req.__("Generate"),
-            req.csrfToken(),
-            { req: req, confirm: true }
-          )
-        ),
+          div(
+            { class: "mt-4 ms-2 d-inline-block" },
+            post_btn(
+              `/auth/remove-api-token`,
+              // TBD localization
+              user.api_token ? req.__("Remove") : req.__("Generate"),
+              req.csrfToken(),
+              { req: req, confirm: true }
+            )
+          ),
       ],
     };
   return {
@@ -1257,13 +1297,13 @@ const userSettings = async ({ req, res, pwform, user }) => {
       },
       ...(usersets
         ? [
-          {
-            type: "card",
-            class: "mt-0",
-            title: userSetsName,
-            contents: usersets,
-          },
-        ]
+            {
+              type: "card",
+              class: "mt-0",
+              title: userSetsName,
+              contents: usersets,
+            },
+          ]
         : []),
       {
         type: "card",
@@ -1286,35 +1326,35 @@ const userSettings = async ({ req, res, pwform, user }) => {
       },
       ...(show2FAPolicy
         ? [
-          {
-            type: "card",
-            title: req.__("Two-factor authentication"),
-            contents: [
-              div(
-                user._attributes.totp_enabled
-                  ? req.__("Two-factor authentication is enabled")
-                  : req.__("Two-factor authentication is disabled")
-              ),
-              div(
-                user._attributes.totp_enabled
-                  ? a(
-                    {
-                      href: "/auth/twofa/disable/totp",
-                      class: "btn btn-danger mt-2",
-                    },
-                    req.__("Disable TWA")
-                  )
-                  : a(
-                    {
-                      href: "/auth/twofa/setup/totp",
-                      class: "btn btn-primary mt-2",
-                    },
-                    req.__("Enable TWA")
-                  )
-              ),
-            ],
-          },
-        ]
+            {
+              type: "card",
+              title: req.__("Two-factor authentication"),
+              contents: [
+                div(
+                  user._attributes.totp_enabled
+                    ? req.__("Two-factor authentication is enabled")
+                    : req.__("Two-factor authentication is disabled")
+                ),
+                div(
+                  user._attributes.totp_enabled
+                    ? a(
+                        {
+                          href: "/auth/twofa/disable/totp",
+                          class: "btn btn-danger mt-2",
+                        },
+                        req.__("Disable TWA")
+                      )
+                    : a(
+                        {
+                          href: "/auth/twofa/setup/totp",
+                          class: "btn btn-primary mt-2",
+                        },
+                        req.__("Enable TWA")
+                      )
+                ),
+              ],
+            },
+          ]
         : []),
       ...(apikeycard ? [apikeycard] : []),
     ],
@@ -1371,18 +1411,15 @@ router.post(
     const newlang = available_languages[req.body.locale];
     if (newlang && u) {
       await u.set_language(req.body.locale);
-      req.login(
-        u.session_object,
-        function (err) {
-          if (!err) {
-            req.flash("success", req.__("Language changed to %s", newlang));
-            res.redirect("/auth/settings");
-          } else {
-            req.flash("danger", err);
-            res.redirect("/auth/settings");
-          }
+      req.login(u.session_object, function (err) {
+        if (!err) {
+          req.flash("success", req.__("Language changed to %s", newlang));
+          res.redirect("/auth/settings");
+        } else {
+          req.flash("danger", err);
+          res.redirect("/auth/settings");
         }
-      );
+      });
     } else {
       req.flash("danger", req.__("Language not found"));
       res.redirect("/auth/settings");
@@ -1479,19 +1516,16 @@ router.post(
     const u = await User.findForSession({ id: req.user.id });
     await u.update({ email: form.values.email });
     u.email = form.values.email;
-    req.login(
-      u.session_object,
-      function (err) {
-        if (!err) {
-          Trigger.emitEvent("Login", null, u);
-          req.flash("success", req.__("Welcome, %s!", u.email));
-          res.redirect("/");
-        } else {
-          req.flash("danger", err);
-          res.redirect("/");
-        }
+    req.login(u.session_object, function (err) {
+      if (!err) {
+        Trigger.emitEvent("Login", null, u);
+        req.flash("success", req.__("Welcome, %s!", u.email));
+        res.redirect("/");
+      } else {
+        req.flash("danger", err);
+        res.redirect("/");
       }
-    );
+    });
   })
 );
 
@@ -1608,8 +1642,9 @@ router.get(
     // generate QR code for scanning into Google Authenticator
     // reference: https://code.google.com/p/google-authenticator/wiki/KeyUriFormat
     const site_name = getState().getConfig("site_name");
-    const otpUrl = `otpauth://totp/${user.email
-      }?secret=${encodedKey}&period=30&issuer=${encodeURIComponent(site_name)}`;
+    const otpUrl = `otpauth://totp/${
+      user.email
+    }?secret=${encodedKey}&period=30&issuer=${encodeURIComponent(site_name)}`;
     const image = await qrcode.toDataURL(otpUrl);
     res.sendWrap(req.__("Setup two-factor authentication"), {
       type: "card",
@@ -1677,7 +1712,9 @@ router.post(
     res.redirect("/auth/settings");
   })
 );
-
+/**
+ * GET /twofa/disable/totp
+ */
 router.get(
   "/twofa/disable/totp",
   loggedIn,
@@ -1692,7 +1729,10 @@ router.get(
     });
   })
 );
-
+/**
+ * POST /twofa/disable/totp
+ * Disable TWA
+ */
 router.post(
   "/twofa/disable/totp",
   loggedIn,
@@ -1726,6 +1766,12 @@ router.post(
     res.redirect("/auth/settings");
   })
 );
+/**
+ * totpForm (TWA)
+ * @param {*} req
+ * @param {*} action
+ * @returns
+ */
 const totpForm = (req, action) =>
   new Form({
     action: action || "/auth/twofa/setup/totp",
@@ -1738,7 +1784,11 @@ const totpForm = (req, action) =>
       },
     ],
   });
-
+/**
+ * Random key generation for totp (TWA)
+ * @param {*} len
+ * @returns
+ */
 const randomKey = function (len) {
   function getRandomInt(min, max) {
     return Math.floor(Math.random() * (max - min + 1)) + min;
@@ -1753,7 +1803,9 @@ const randomKey = function (len) {
 
   return buf.join("");
 };
-
+/**
+ * GET /twofa/login/totp
+ */
 router.get(
   "/twofa/login/totp",
   error_catcher(async (req, res) => {
@@ -1772,7 +1824,9 @@ router.get(
     res.sendAuthWrap(req.__(`Two-factor authentication`), form, {});
   })
 );
-
+/**
+ * POST /twofa/login/totp
+ */
 router.post(
   "/twofa/login/totp",
   passport.authenticate("totp", {