@saltcorn/server 0.8.8-beta.3 → 0.8.8-beta.4

package/locales/en.json

@@ -1242,5 +1242,9 @@
 	"unsynched": "unsynched",
 	"synched": "synched",
 	"Sync information": "Sync information",
-	"Sync information tracks the last modification or deletion timestamp so that the table data can be synchronized with the mobile app": "Sync information tracks the last modification or deletion timestamp so that the table data can be synchronized with the mobile app"
-}
+	"Sync information tracks the last modification or deletion timestamp so that the table data can be synchronized with the mobile app": "Sync information tracks the last modification or deletion timestamp so that the table data can be synchronized with the mobile app",
+	"Included Plugins": "Included Plugins",
+	"exclude": "exclude",
+	"include": "include",
+	"Auto public login": "Auto public login"
+}

package/package.json

@@ -1,18 +1,18 @@
 {
   "name": "@saltcorn/server",
-  "version": "0.8.8-beta.3",
+  "version": "0.8.8-beta.4",
   "description": "Server app for Saltcorn, open-source no-code platform",
   "homepage": "https://saltcorn.com",
   "main": "index.js",
   "license": "MIT",
   "dependencies": {
-    "@saltcorn/base-plugin": "0.8.8-beta.3",
-    "@saltcorn/builder": "0.8.8-beta.3",
-    "@saltcorn/data": "0.8.8-beta.3",
-    "@saltcorn/admin-models": "0.8.8-beta.3",
-    "@saltcorn/filemanager": "0.8.8-beta.3",
-    "@saltcorn/markup": "0.8.8-beta.3",
-    "@saltcorn/sbadmin2": "0.8.8-beta.3",
+    "@saltcorn/base-plugin": "0.8.8-beta.4",
+    "@saltcorn/builder": "0.8.8-beta.4",
+    "@saltcorn/data": "0.8.8-beta.4",
+    "@saltcorn/admin-models": "0.8.8-beta.4",
+    "@saltcorn/filemanager": "0.8.8-beta.4",
+    "@saltcorn/markup": "0.8.8-beta.4",
+    "@saltcorn/sbadmin2": "0.8.8-beta.4",
     "@socket.io/cluster-adapter": "^0.2.1",
     "@socket.io/sticky": "^1.0.1",
     "adm-zip": "0.5.10",

package/public/saltcorn.js

@@ -678,6 +678,10 @@ function build_mobile_app(button) {
   params.synchedTables = Array.from($("#synched-tbls-select-id")[0].options)
     .filter((option) => !option.hidden)
     .map((option) => option.value);
+  const pluginsSelect = $("#included-plugins-select-id")[0];
+  params.includedPlugins = Array.from(pluginsSelect.options)
+    .filter((option) => !option.hidden)
+    .map((option) => option.value);
   ajax_post("/admin/build-mobile-app", {
     data: params,
     success: (data) => {
@@ -717,6 +721,32 @@ function move_to_unsynched() {
   }
 }
 
+function move_plugin_to_included() {
+  const opts = $("#excluded-plugins-select-id");
+  $("#included-plugins-select-id").removeAttr("selected");
+  for (const selected of opts.val()) {
+    const jExclOpt = $(`[id='${selected}_excluded_opt']`);
+    jExclOpt.attr("hidden", "true");
+    jExclOpt.removeAttr("selected");
+    const jInclOpt = $(`[id='${selected}_included_opt']`);
+    jInclOpt.removeAttr("hidden");
+    jInclOpt.removeAttr("selected");
+  }
+}
+
+function move_plugin_to_excluded() {
+  const opts = $("#included-plugins-select-id");
+  $("#excluded-plugins-select-id").removeAttr("selected");
+  for (const selected of opts.val()) {
+    const jInclOpt = $(`[id='${selected}_included_opt']`);
+    jInclOpt.attr("hidden", "true");
+    jInclOpt.removeAttr("selected");
+    const jExclOpt = $(`[id='${selected}_excluded_opt']`);
+    jExclOpt.removeAttr("hidden");
+    jExclOpt.removeAttr("selected");
+  }
+}
+
 function toggle_tbl_sync() {
   if ($("#offlineModeBoxId")[0].checked === true) {
     $("#tblSyncSelectorId").attr("hidden", false);

package/routes/admin.js

@@ -1492,6 +1492,9 @@ router.get(
       image.filename?.endsWith(".png")
     );
     const withSyncInfo = await Table.find({ has_sync_info: true });
+    const plugins = (await Plugin.find()).filter(
+      (plugin) => ["base", "sbadmin2"].indexOf(plugin.name) < 0
+    );
     send_admin_page({
       res,
       req,
@@ -1750,7 +1753,29 @@ router.get(
                       )
                     )
                   ),
-
+                  // auto public login box
+                  div(
+                    { class: "row pb-2" },
+                    div(
+                      { class: "col-sm-4" },
+                      input({
+                        type: "checkbox",
+                        id: "autoPublLoginId",
+                        class: "form-check-input me-2",
+                        name: "autoPublicLogin",
+                        value: "autoPublicLogin",
+                        checked: false,
+                      }),
+                      label(
+                        {
+                          for: "autoPublLoginId",
+                          class: "form-label",
+                        },
+                        req.__("Auto public login")
+                      )
+                    )
+                  ),
+                  // allow offline mode box
                   div(
                     { class: "row pb-2" },
                     div(
@@ -1773,10 +1798,11 @@ router.get(
                       )
                     )
                   ),
+                  // synched/unsynched tables
                   div(
                     {
                       id: "tblSyncSelectorId",
-                      class: "row pb-2",
+                      class: "row pb-3",
                     },
                     div(
                       label(
@@ -1864,6 +1890,97 @@ router.get(
                         )
                       )
                     )
+                  ),
+                  // included/excluded plugins
+                  div(
+                    {
+                      id: "pluginsSelectorId",
+                      class: "row pb-2",
+                    },
+                    div(
+                      label({ class: "form-label fw-bold" }, req.__("Plugins"))
+                    ),
+                    div(
+                      { class: "container" },
+                      div(
+                        { class: "row" },
+                        div(
+                          { class: "col-sm-4 text-center" },
+                          req.__("exclude")
+                        ),
+                        div({ class: "col-sm-1" }),
+                        div(
+                          { class: "col-sm-4 text-center" },
+                          req.__("include")
+                        )
+                      ),
+                      div(
+                        { class: "row" },
+                        div(
+                          { class: "col-sm-4" },
+                          select(
+                            {
+                              id: "excluded-plugins-select-id",
+                              class: "form-control form-select",
+                              multiple: true,
+                            },
+                            plugins.map((plugin) =>
+                              option({
+                                id: `${plugin.name}_excluded_opt`,
+                                value: plugin.name,
+                                label: plugin.name,
+                                hidden: "true",
+                              })
+                            )
+                          )
+                        ),
+                        div(
+                          { class: "col-sm-1 d-flex justify-content-center" },
+                          div(
+                            div(
+                              button(
+                                {
+                                  id: "move-plugin-right-btn-id",
+                                  type: "button",
+                                  onClick: `move_plugin_to_included()`,
+                                  class: "btn btn-light pt-1 mb-1",
+                                },
+                                i({ class: "fas fa-arrow-right" })
+                              )
+                            ),
+                            div(
+                              button(
+                                {
+                                  id: "move-plugin-left-btn-id",
+                                  type: "button",
+                                  onClick: `move_plugin_to_excluded()`,
+                                  class: "btn btn-light pt-1",
+                                },
+                                i({ class: "fas fa-arrow-left" })
+                              )
+                            )
+                          )
+                        ),
+                        div(
+                          { class: "col-sm-4" },
+                          select(
+                            {
+                              id: "included-plugins-select-id",
+                              class: "form-control form-select",
+                              multiple: true,
+                            },
+                            plugins.map((plugin) =>
+                              option({
+                                id: `${plugin.name}_included_opt`,
+                                value: plugin.name,
+                                label: plugin.name,
+                                // hidden: "true",
+                              })
+                            )
+                          )
+                        )
+                      )
+                    )
                   )
                 ),
                 button(
@@ -1969,8 +2086,10 @@ router.post(
       appIcon,
       serverURL,
       splashPage,
+      autoPublicLogin,
       allowOfflineMode,
       synchedTables,
+      includedPlugins,
     } = req.body;
     if (!androidPlatform && !iOSPlatform) {
       return res.json({
@@ -2022,8 +2141,14 @@ router.post(
     if (serverURL) spawnParams.push("-s", serverURL);
     if (splashPage) spawnParams.push("--splashPage", splashPage);
     if (allowOfflineMode) spawnParams.push("--allowOfflineMode");
+    if (autoPublicLogin) spawnParams.push("--autoPublicLogin");
     if (synchedTables?.length > 0)
       spawnParams.push("--synchedTables", ...synchedTables.map((tbl) => tbl));
+    if (includedPlugins?.length > 0)
+      spawnParams.push(
+        "--includedPlugins",
+        ...includedPlugins.map((pluginName) => pluginName)
+      );
     if (
       db.is_it_multi_tenant() &&
       db.getTenantSchema() !== db.connectObj.default_schema

package/routes/sync.js

@@ -24,9 +24,30 @@ router.get(
   })
 );
 
-const getSyncRows = async (syncInfo, table, syncUntil, client) => {
+const getSyncRows = async (syncInfo, table, syncUntil, client, user) => {
   const tblName = table.name;
   const pkName = table.pk_name;
+  const minRole = table.min_role_read;
+  const role = user?.role_id || 100;
+  let ownerFieldName = null;
+  if (
+    role > minRole &&
+    ((!table.ownership_field_id && !table.ownership_formula) || role === 100)
+  )
+    return null;
+  if (user?.id && role < 100 && role > minRole && table.ownership_field_id) {
+    const ownerField = table
+      .getFields()
+      .find((f) => f.id === table.ownership_field_id);
+    if (!ownerField) {
+      getState().log(
+        5,
+        `GET /load_changes: The ownership field of '${table.name}' does not exist.`
+      );
+      return null;
+    }
+    ownerFieldName = ownerField.name;
+  }
   const schema = db.getTenantSchemaPrefix();
   if (!syncInfo.syncFrom) {
     const { rows } = await client.query(
@@ -43,9 +64,9 @@ const getSyncRows = async (syncInfo, table, syncUntil, client) => {
       on info_tbl.ref = data_tbl."${db.sqlsanitize(
         pkName
       )}" and info_tbl.deleted = false
-      where data_tbl."${db.sqlsanitize(pkName)}" > ${
-        syncInfo.maxLoadedId
-      } order by data_tbl."${db.sqlsanitize(pkName)}"`
+      where data_tbl."${db.sqlsanitize(pkName)}" > ${syncInfo.maxLoadedId}
+      ${ownerFieldName ? `and data_tbl."${ownerFieldName}" = ${user.id}` : ""}
+      order by data_tbl."${db.sqlsanitize(pkName)}"`
     );
     for (const row of rows) {
       if (row._sync_info_tbl_last_modified_)
@@ -76,6 +97,7 @@ const getSyncRows = async (syncInfo, table, syncUntil, client) => {
       }) 
       and info_tbl.deleted = false
       and info_tbl.ref > ${syncInfo.maxLoadedId}
+      ${ownerFieldName ? `and data_tbl."${ownerFieldName}" = ${user.id}` : ""}
       order by info_tbl.ref`
     );
     for (const row of rows) {
@@ -114,7 +136,14 @@ router.post(
         const table = Table.findOne({ name: tblName });
         if (!table) throw new Error(`The table '${tblName}' does not exists`);
         const pkName = table.pk_name;
-        let rows = await getSyncRows(syncInfo, table, loadUntil, client);
+        let rows = await getSyncRows(
+          syncInfo,
+          table,
+          loadUntil,
+          client,
+          req.user
+        );
+        if (!rows) continue;
         if (role > table.min_role_read) {
           if (
             role === 100 ||

package/tests/sync.test.js

@@ -10,6 +10,8 @@ const db = require("@saltcorn/data/db");
 const { sleep } = require("@saltcorn/data/tests/mocks");
 
 const Table = require("@saltcorn/data/models/table");
+const Field = require("@saltcorn/data/models/field");
+const User = require("@saltcorn/data/models/user");
 
 beforeAll(async () => {
   await resetToFixtures();
@@ -32,7 +34,7 @@ const initSyncInfo = async (tbls) => {
 describe("load remote insert/updates", () => {
   if (!db.isSQLite) {
     beforeAll(async () => {
-      await initSyncInfo(["books", "publisher"]);
+      await initSyncInfo(["books", "publisher", "patients"]);
     });
     it("check params", async () => {
       const app = await getApp({ disableCsrf: true });
@@ -178,6 +180,99 @@ describe("load remote insert/updates", () => {
         expect(data.books.rows[1].author).toBe("Leo Tolstoy");
       }
     });
+
+    it("load sync not authorized", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getUserLoginCookie();
+      const loadUntil = new Date();
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            patients: {
+              maxLoadedId: 0,
+              syncFrom: 1000,
+            },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const data = resp._body;
+      expect(Object.keys(data).length).toBe(0);
+    });
+
+    const addOwnerField = async () => {
+      const patients = Table.findOne({ name: "patients" });
+      const users = Table.findOne({ name: "users" });
+      const ownerField = await Field.create({
+        table: patients,
+        name: "owner",
+        label: "Pages",
+        type: "Key",
+        reftable: users,
+        attributes: { summary_field: "id" },
+      });
+      patients.ownership_field_id = ownerField.id;
+      await patients.update(patients);
+      const user = await User.findOne({ email: "user@foo.com" });
+      await patients.updateRow({ owner: user.id }, 1);
+    };
+
+    it("load sync authorized with ownership", async () => {
+      await addOwnerField();
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getUserLoginCookie();
+      const loadUntil = new Date();
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            patients: {
+              maxLoadedId: 0,
+            },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const data = resp._body;
+      expect(Object.keys(data).length).toBe(1);
+      expect(data.patients).toBeDefined();
+      expect(data.patients.rows.length).toBe(1);
+      expect(data.patients.rows[0].id).toBe(1);
+    });
+
+    it("load sync authorized with ownership and syncFrom", async () => {
+      const patients = Table.findOne({ name: "patients" });
+      if (!patients.ownership_field_id) await addOwnerField();
+      const rows = await patients.getRows();
+      for (const row of rows) {
+        await patients.updateRow(row, row.id);
+      }
+
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getUserLoginCookie();
+      const loadUntil = new Date();
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            patients: {
+              maxLoadedId: 0,
+              syncFrom: 1000,
+            },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const data = resp._body;
+      expect(Object.keys(data).length).toBe(1);
+      expect(data.patients).toBeDefined();
+      expect(data.patients.rows.length).toBe(1);
+      expect(data.patients.rows[0].id).toBe(1);
+    });
   } else
     it("only pq support", () => {
       expect(true).toBe(true);