@saltcorn/server 0.8.8-beta.3 → 0.8.8-beta.5

package/auth/routes.js

@@ -254,7 +254,9 @@ const loginWithJwt = async (email, password, saltcornApp, res, req) => {
         res.json(token);
       } else {
         res.json({
-          alerts: [{ type: "danger", msg: req.__("Incorrect user or password") }],
+          alerts: [
+            { type: "danger", msg: req.__("Incorrect user or password") },
+          ],
         });
       }
     } else if (publicUserLink) {
@@ -276,7 +278,9 @@ const loginWithJwt = async (email, password, saltcornApp, res, req) => {
       res.json(token);
     } else {
       res.json({
-        alerts: [{ type: "danger", msg: req.__("The public login is deactivated") }],
+        alerts: [
+          { type: "danger", msg: req.__("The public login is deactivated") },
+        ],
       });
     }
   };
@@ -628,9 +632,11 @@ router.post(
  * @throws {InvalidConfiguration}
  */
 const getNewUserForm = async (new_user_view_name, req, askEmail) => {
+  if (!new_user_view_name) return;
   const view = await View.findOne({ name: new_user_view_name });
   if (!view)
     throw new InvalidConfiguration("New user form view does not exist");
+  if (view.viewtemplate !== "Edit") return;
   const table = Table.findOne({ name: "users" });
   const fields = table.getFields();
   const { columns, layout } = view.configuration;
@@ -704,14 +710,14 @@ const getNewUserForm = async (new_user_view_name, req, askEmail) => {
  * @param {object} res
  * @returns {void}
  */
-const signup_login_with_user = (u, req, res) =>
+const signup_login_with_user = (u, req, res, redirUrl) =>
   req.login(u.session_object, function (err) {
     if (!err) {
       Trigger.emitEvent("Login", null, u);
       if (getState().verifier) res.redirect("/auth/verification-flow");
       else if (getState().get2FApolicy(u) === "Mandatory")
         res.redirect("/auth/twofa/setup/totp");
-      else res.redirect("/");
+      else res.redirect(redirUrl || "/");
     } else {
       req.flash("danger", err);
       res.redirect("/auth/signup");
@@ -869,7 +875,8 @@ router.post(
       return;
     }
 
-    const unsuitableEmailPassword = async (email, password, passwordRepeat) => {
+    const unsuitableEmailPassword = async (urecord) => {
+      const { email, password, passwordRepeat } = urecord;
       if (!email || !password) {
         req.flash("danger", req.__("E-mail and password required"));
         res.redirect("/auth/signup");
@@ -911,6 +918,12 @@ router.post(
         res.redirect("/auth/signup");
         return true;
       }
+      let constraint_check_error = User.table.check_table_constraints(urecord);
+      if (constraint_check_error) {
+        req.flash("danger", constraint_check_error);
+        res.redirect("/auth/signup");
+        return true;
+      }
     };
     const new_user_form = getState().getConfig("new_user_form");
 
@@ -943,21 +956,32 @@ router.post(
             signup_form.values[f.name] = signup_form.values[f.name] || "";
         });
         const userObject = signup_form.values;
-        const { email, password, passwordRepeat } = userObject;
-        if (await unsuitableEmailPassword(email, password, passwordRepeat))
-          return;
-        if (new_user_form) {
-          const form = await getNewUserForm(new_user_form, req);
+        //const { email, password, passwordRepeat } = userObject;
+        if (await unsuitableEmailPassword(userObject)) return;
+        const new_user_form_form = await getNewUserForm(new_user_form, req);
+        if (new_user_form_form) {
           Object.entries(userObject).forEach(([k, v]) => {
-            form.values[k] = v;
-            if (!form.fields.find((f) => f.name === k)) form.hidden(k);
+            new_user_form_form.values[k] = v;
+            if (!new_user_form_form.fields.find((f) => f.name === k))
+              new_user_form_form.hidden(k);
           });
-          res.sendAuthWrap(new_user_form, form, getAuthLinks("signup", true));
+          res.sendAuthWrap(
+            new_user_form,
+            new_user_form_form,
+            getAuthLinks("signup", true)
+          );
         } else {
           const u = await User.create(userObject);
           await send_verification_email(u, req);
 
-          signup_login_with_user(u, req, res);
+          signup_login_with_user(
+            u,
+            req,
+            res,
+            new_user_form && !new_user_form_form
+              ? `/view/${new_user_form}?id=${u.id}`
+              : undefined
+          );
         }
         return;
       }
@@ -972,7 +996,7 @@ router.post(
       res.sendAuthWrap(req.__(`Sign up`), form, getAuthLinks("signup"));
     } else {
       const { email, password } = form.values;
-      if (await unsuitableEmailPassword(email, password)) return;
+      if (await unsuitableEmailPassword({ email, password })) return;
       if (new_user_form) {
         const form = await getNewUserForm(new_user_form, req);
         form.values.email = email;
@@ -1100,7 +1124,13 @@ router.get(
     const { method } = req.params;
     if (method === "jwt") {
       const { email, password } = req.query;
-      await loginWithJwt(email, password, req.headers["x-saltcorn-app"], res, req);
+      await loginWithJwt(
+        email,
+        password,
+        req.headers["x-saltcorn-app"],
+        res,
+        req
+      );
     } else {
       const auth = getState().auth_methods[method];
       if (auth) {

package/locales/en.json

@@ -1242,5 +1242,11 @@
 	"unsynched": "unsynched",
 	"synched": "synched",
 	"Sync information": "Sync information",
-	"Sync information tracks the last modification or deletion timestamp so that the table data can be synchronized with the mobile app": "Sync information tracks the last modification or deletion timestamp so that the table data can be synchronized with the mobile app"
+	"Sync information tracks the last modification or deletion timestamp so that the table data can be synchronized with the mobile app": "Sync information tracks the last modification or deletion timestamp so that the table data can be synchronized with the mobile app",
+	"Included Plugins": "Included Plugins",
+	"exclude": "exclude",
+	"include": "include",
+	"Auto public login": "Auto public login",
+	"New user view": "New user view",
+	"A view to show to new users, to finalise registration (if Edit) or as a welcome view": "A view to show to new users, to finalise registration (if Edit) or as a welcome view"
 }

package/locales/it.json

@@ -503,5 +503,20 @@
 	"Table columns": "Table columns",
 	"Configuration items": "Configuration items",
 	"Crashlogs": "Crashlogs",
-	"Logged out user %s": "Logged out user %s"
-}
+	"Logged out user %s": "Logged out user %s",
+	"CSV upload": "CSV upload",
+	"Pages are the web pages of your application built with a drag-and-drop builder. They have static content, and by embedding views, dynamic content.": "Pages are the web pages of your application built with a drag-and-drop builder. They have static content, and by embedding views, dynamic content.",
+	"Create page": "Create page",
+	"Triggers run actions in response to events.": "Triggers run actions in response to events.",
+	"No triggers": "No triggers",
+	"Upload file(s)": "Upload file(s)",
+	"Pattern": "Pattern",
+	"You have views with a role to access lower than the table role to read, with no table ownership. This may cause a denial of access. Users need to have table read access to any data displayed.": "You have views with a role to access lower than the table role to read, with no table ownership. This may cause a denial of access. Users need to have table read access to any data displayed.",
+	"Views potentially affected": "Views potentially affected",
+	"Fixed and blocked fields": "Fixed and blocked fields",
+	"URL after delete": "URL after delete",
+	"Save before going back": "Save before going back",
+	"Reload after going back": "Reload after going back",
+	"Steps to go back": "Steps to go back",
+	"%s configuration": "%s configuration"
+}

package/package.json

@@ -1,18 +1,18 @@
 {
   "name": "@saltcorn/server",
-  "version": "0.8.8-beta.3",
+  "version": "0.8.8-beta.5",
   "description": "Server app for Saltcorn, open-source no-code platform",
   "homepage": "https://saltcorn.com",
   "main": "index.js",
   "license": "MIT",
   "dependencies": {
-    "@saltcorn/base-plugin": "0.8.8-beta.3",
-    "@saltcorn/builder": "0.8.8-beta.3",
-    "@saltcorn/data": "0.8.8-beta.3",
-    "@saltcorn/admin-models": "0.8.8-beta.3",
-    "@saltcorn/filemanager": "0.8.8-beta.3",
-    "@saltcorn/markup": "0.8.8-beta.3",
-    "@saltcorn/sbadmin2": "0.8.8-beta.3",
+    "@saltcorn/base-plugin": "0.8.8-beta.5",
+    "@saltcorn/builder": "0.8.8-beta.5",
+    "@saltcorn/data": "0.8.8-beta.5",
+    "@saltcorn/admin-models": "0.8.8-beta.5",
+    "@saltcorn/filemanager": "0.8.8-beta.5",
+    "@saltcorn/markup": "0.8.8-beta.5",
+    "@saltcorn/sbadmin2": "0.8.8-beta.5",
     "@socket.io/cluster-adapter": "^0.2.1",
     "@socket.io/sticky": "^1.0.1",
     "adm-zip": "0.5.10",

package/public/saltcorn-common.js

@@ -41,6 +41,15 @@ const _apply_showif_plugins = [];
 const add_apply_showif_plugin = (p) => {
   _apply_showif_plugins.push(p);
 };
+
+const nubBy = (prop, xs) => {
+  const vs = new Set();
+  return xs.filter((x) => {
+    if (vs.has(x[prop])) return false;
+    vs.add(x[prop]);
+    return true;
+  });
+};
 function apply_showif() {
   $("[data-show-if]").each(function (ix, element) {
     var e = $(element);
@@ -109,10 +118,16 @@ function apply_showif() {
     const dynwhere = JSON.parse(
       decodeURIComponent(e.attr("data-fetch-options"))
     );
-    //console.log(dynwhere);
-    const qs = Object.entries(dynwhere.whereParsed)
-      .map(([k, v]) => `${k}=${v[0] === "$" ? rec[v.substring(1)] : v}`)
-      .join("&");
+    //console.log("dynwhere", dynwhere);
+    const qss = Object.entries(dynwhere.whereParsed).map(
+      ([k, v]) => `${k}=${v[0] === "$" ? rec[v.substring(1)] : v}`
+    );
+    if (dynwhere.dereference) {
+      if (Array.isArray(dynwhere.dereference))
+        qss.push(...dynwhere.dereference.map((d) => `dereference=${d}`));
+      else qss.push(`dereference=${dynwhere.dereference}`);
+    }
+    const qs = qss.join("&");
     var current = e.attr("data-selected");
     e.change(function (ec) {
       e.attr("data-selected", ec.target.value);
@@ -129,7 +144,11 @@ function apply_showif() {
       if (!dynwhere.required) toAppend.push(`<option></option>`);
       let currentDataOption = undefined;
       const dataOptions = [];
-      success.forEach((r) => {
+      //console.log(success);
+      const success1 = dynwhere.nubBy
+        ? nubBy(dynwhere.nubBy, success)
+        : success;
+      success1.forEach((r) => {
         const label = dynwhere.label_formula
           ? new Function(
               `{${Object.keys(r).join(",")}}`,
@@ -137,6 +156,7 @@ function apply_showif() {
             )(r)
           : r[dynwhere.summary_field];
         const value = r[dynwhere.refname];
+        //console.log("lv", label, value, r, dynwhere.summary_field);
         const selected = `${current}` === `${r[dynwhere.refname]}`;
         dataOptions.push({ text: label, value });
         if (selected) currentDataOption = value;
@@ -510,6 +530,14 @@ function initialize_page() {
     if (schema) {
       schema = JSON.parse(decodeURIComponent(schema));
     }
+    if (type === "Date") {
+      console.log("timeelsems", $(this).find("span.current time"));
+      current =
+        $(this).attr("data-inline-edit-current") ||
+        $(this).find("span.current time").attr("datetime"); // ||
+      //$(this).children("span.current").html();
+    }
+    console.log({ type, current });
     var is_key = type?.startsWith("Key:");
     const opts = encodeURIComponent(
       JSON.stringify({
@@ -875,7 +903,7 @@ function common_done(res, isWeb = true) {
   if (res.eval_js) handle(res.eval_js, eval);
 
   if (res.reload_page) {
-    (isWeb ? location : parent.location).reload(); //TODO notify to cookie if reload or goto
+    (isWeb ? location : parent).reload(); //TODO notify to cookie if reload or goto
   }
   if (res.download) {
     handle(res.download, (download) => {

package/public/saltcorn.js

@@ -389,6 +389,20 @@ function saveAndContinue(e, k) {
   return false;
 }
 
+function updateMatchingRows(e, viewname) {
+  const form = $(e).closest("form");
+  try {
+    const sp = `${new URL(get_current_state_url()).searchParams.toString()}`;
+    form.attr(
+      "action",
+      `/view/${viewname}/update_matching_rows${sp ? `?${sp}` : ""}`
+    );
+    form[0].submit();
+  } finally {
+    form.attr("action", `/view/${viewname}`);
+  }
+}
+
 function applyViewConfig(e, url, k) {
   var form = $(e).closest("form");
   var form_data = form.serializeArray();
@@ -678,6 +692,10 @@ function build_mobile_app(button) {
   params.synchedTables = Array.from($("#synched-tbls-select-id")[0].options)
     .filter((option) => !option.hidden)
     .map((option) => option.value);
+  const pluginsSelect = $("#included-plugins-select-id")[0];
+  params.includedPlugins = Array.from(pluginsSelect.options)
+    .filter((option) => !option.hidden)
+    .map((option) => option.value);
   ajax_post("/admin/build-mobile-app", {
     data: params,
     success: (data) => {
@@ -717,6 +735,32 @@ function move_to_unsynched() {
   }
 }
 
+function move_plugin_to_included() {
+  const opts = $("#excluded-plugins-select-id");
+  $("#included-plugins-select-id").removeAttr("selected");
+  for (const selected of opts.val()) {
+    const jExclOpt = $(`[id='${selected}_excluded_opt']`);
+    jExclOpt.attr("hidden", "true");
+    jExclOpt.removeAttr("selected");
+    const jInclOpt = $(`[id='${selected}_included_opt']`);
+    jInclOpt.removeAttr("hidden");
+    jInclOpt.removeAttr("selected");
+  }
+}
+
+function move_plugin_to_excluded() {
+  const opts = $("#included-plugins-select-id");
+  $("#excluded-plugins-select-id").removeAttr("selected");
+  for (const selected of opts.val()) {
+    const jInclOpt = $(`[id='${selected}_included_opt']`);
+    jInclOpt.attr("hidden", "true");
+    jInclOpt.removeAttr("selected");
+    const jExclOpt = $(`[id='${selected}_excluded_opt']`);
+    jExclOpt.removeAttr("hidden");
+    jExclOpt.removeAttr("selected");
+  }
+}
+
 function toggle_tbl_sync() {
   if ($("#offlineModeBoxId")[0].checked === true) {
     $("#tblSyncSelectorId").attr("hidden", false);
@@ -725,6 +769,18 @@ function toggle_tbl_sync() {
   }
 }
 
+function toggle_android_platform() {
+  if ($("#androidCheckboxId")[0].checked === true) {
+    $("#dockerCheckboxId").attr("hidden", false);
+    $("#dockerCheckboxId").attr("checked", true);
+    $("#dockerLabelId").removeClass("d-none");
+  } else {
+    $("#dockerCheckboxId").attr("hidden", true);
+    $("#dockerCheckboxId").attr("checked", false);
+    $("#dockerLabelId").addClass("d-none");
+  }
+}
+
 function join_field_clicked(e, fieldPath) {
   $("#inputjoin_field").val(fieldPath);
   apply_showif();

package/routes/admin.js

@@ -1492,6 +1492,9 @@ router.get(
       image.filename?.endsWith(".png")
     );
     const withSyncInfo = await Table.find({ has_sync_info: true });
+    const plugins = (await Plugin.find()).filter(
+      (plugin) => ["base", "sbadmin2"].indexOf(plugin.name) < 0
+    );
     send_admin_page({
       res,
       req,
@@ -1532,7 +1535,9 @@ router.get(
                     div({ class: "col-sm-4 fw-bold" }, req.__("Platform")),
                     div(
                       {
-                        class: "col-sm-1 fw-bold d-flex justify-content-center",
+                        class:
+                          "col-sm-1 fw-bold d-flex justify-content-center d-none",
+                        id: "dockerLabelId",
                       },
                       req.__("docker")
                     )
@@ -1593,7 +1598,7 @@ router.get(
                     ),
                     div(
                       { class: "col-sm-4" },
-
+                      // android
                       div(
                         { class: "container ps-0" },
                         div(
@@ -1606,9 +1611,11 @@ router.get(
                               class: "form-check-input",
                               name: "androidPlatform",
                               id: "androidCheckboxId",
+                              onClick: "toggle_android_platform()",
                             })
                           )
                         ),
+                        // iOS
                         div(
                           { class: "row" },
                           div({ class: "col-sm-8" }, req.__("iOS")),
@@ -1624,6 +1631,7 @@ router.get(
                         )
                       )
                     ),
+                    // android with docker
                     div(
                       { class: "col-sm-1 d-flex justify-content-center" },
                       input({
@@ -1631,6 +1639,7 @@ router.get(
                         class: "form-check-input",
                         name: "useDocker",
                         id: "dockerCheckboxId",
+                        hidden: true,
                       })
                     )
                   ),
@@ -1750,7 +1759,29 @@ router.get(
                       )
                     )
                   ),
-
+                  // auto public login box
+                  div(
+                    { class: "row pb-2" },
+                    div(
+                      { class: "col-sm-4" },
+                      input({
+                        type: "checkbox",
+                        id: "autoPublLoginId",
+                        class: "form-check-input me-2",
+                        name: "autoPublicLogin",
+                        value: "autoPublicLogin",
+                        checked: false,
+                      }),
+                      label(
+                        {
+                          for: "autoPublLoginId",
+                          class: "form-label",
+                        },
+                        req.__("Auto public login")
+                      )
+                    )
+                  ),
+                  // allow offline mode box
                   div(
                     { class: "row pb-2" },
                     div(
@@ -1773,10 +1804,11 @@ router.get(
                       )
                     )
                   ),
+                  // synched/unsynched tables
                   div(
                     {
                       id: "tblSyncSelectorId",
-                      class: "row pb-2",
+                      class: "row pb-3",
                     },
                     div(
                       label(
@@ -1864,6 +1896,97 @@ router.get(
                         )
                       )
                     )
+                  ),
+                  // included/excluded plugins
+                  div(
+                    {
+                      id: "pluginsSelectorId",
+                      class: "row pb-2",
+                    },
+                    div(
+                      label({ class: "form-label fw-bold" }, req.__("Plugins"))
+                    ),
+                    div(
+                      { class: "container" },
+                      div(
+                        { class: "row" },
+                        div(
+                          { class: "col-sm-4 text-center" },
+                          req.__("exclude")
+                        ),
+                        div({ class: "col-sm-1" }),
+                        div(
+                          { class: "col-sm-4 text-center" },
+                          req.__("include")
+                        )
+                      ),
+                      div(
+                        { class: "row" },
+                        div(
+                          { class: "col-sm-4" },
+                          select(
+                            {
+                              id: "excluded-plugins-select-id",
+                              class: "form-control form-select",
+                              multiple: true,
+                            },
+                            plugins.map((plugin) =>
+                              option({
+                                id: `${plugin.name}_excluded_opt`,
+                                value: plugin.name,
+                                label: plugin.name,
+                                hidden: "true",
+                              })
+                            )
+                          )
+                        ),
+                        div(
+                          { class: "col-sm-1 d-flex justify-content-center" },
+                          div(
+                            div(
+                              button(
+                                {
+                                  id: "move-plugin-right-btn-id",
+                                  type: "button",
+                                  onClick: `move_plugin_to_included()`,
+                                  class: "btn btn-light pt-1 mb-1",
+                                },
+                                i({ class: "fas fa-arrow-right" })
+                              )
+                            ),
+                            div(
+                              button(
+                                {
+                                  id: "move-plugin-left-btn-id",
+                                  type: "button",
+                                  onClick: `move_plugin_to_excluded()`,
+                                  class: "btn btn-light pt-1",
+                                },
+                                i({ class: "fas fa-arrow-left" })
+                              )
+                            )
+                          )
+                        ),
+                        div(
+                          { class: "col-sm-4" },
+                          select(
+                            {
+                              id: "included-plugins-select-id",
+                              class: "form-control form-select",
+                              multiple: true,
+                            },
+                            plugins.map((plugin) =>
+                              option({
+                                id: `${plugin.name}_included_opt`,
+                                value: plugin.name,
+                                label: plugin.name,
+                                // hidden: "true",
+                              })
+                            )
+                          )
+                        )
+                      )
+                    )
                   )
                 ),
                 button(
@@ -1969,8 +2092,10 @@ router.post(
       appIcon,
       serverURL,
       splashPage,
+      autoPublicLogin,
       allowOfflineMode,
       synchedTables,
+      includedPlugins,
     } = req.body;
     if (!androidPlatform && !iOSPlatform) {
       return res.json({
@@ -2022,8 +2147,14 @@ router.post(
     if (serverURL) spawnParams.push("-s", serverURL);
     if (splashPage) spawnParams.push("--splashPage", splashPage);
     if (allowOfflineMode) spawnParams.push("--allowOfflineMode");
+    if (autoPublicLogin) spawnParams.push("--autoPublicLogin");
     if (synchedTables?.length > 0)
       spawnParams.push("--synchedTables", ...synchedTables.map((tbl) => tbl));
+    if (includedPlugins?.length > 0)
+      spawnParams.push(
+        "--includedPlugins",
+        ...includedPlugins.map((pluginName) => pluginName)
+      );
     if (
       db.is_it_multi_tenant() &&
       db.getTenantSchema() !== db.connectObj.default_schema

package/routes/api.js

@@ -251,7 +251,8 @@ router.get(
   //passport.authenticate("api-bearer", { session: false }),
   error_catcher(async (req, res, next) => {
     let { tableName } = req.params;
-    const { fields, versioncount, approximate, ...req_query } = req.query;
+    const { fields, versioncount, approximate, dereference, ...req_query } =
+      req.query;
     const table = Table.findOne(
       strictParseInt(tableName)
         ? { id: strictParseInt(tableName) }
@@ -284,7 +285,7 @@ router.get(
               },
             };
             rows = await table.getJoinedRows(joinOpts);
-          } else if (req_query && req_query !== {}) {
+          } else {
             const tbl_fields = table.getFields();
             readState(req_query, tbl_fields, req);
             const qstate = await stateFieldsToWhere({
@@ -293,18 +294,26 @@ router.get(
               state: req_query,
               table,
             });
-            rows = await table.getRows(qstate, {
+            const joinFields = {};
+            const derefs = Array.isArray(dereference)
+              ? dereference
+              : !dereference
+              ? []
+              : [dereference];
+            derefs.forEach((f) => {
+              const field = table.getField(f);
+              if (field?.attributes?.summary_field)
+                joinFields[`${f}_${field?.attributes?.summary_field}`] = {
+                  ref: f,
+                  target: field?.attributes?.summary_field,
+                };
+            });
+            rows = await table.getJoinedRows({
+              where: qstate,
+              joinFields,
               forPublic: !(req.user || user),
               forUser: req.user || user,
             });
-          } else {
-            rows = await table.getRows(
-              {},
-              {
-                forPublic: !(req.user || user),
-                forUser: req.user || user,
-              }
-            );
           }
           res.json({ success: rows.map(limitFields(fields)) });
         } else {

package/routes/eventlog.js

@@ -180,6 +180,7 @@ const customEventForm = async (req) => {
         name: "name",
         label: req.__("Event Name"),
         type: "String",
+        required: true,
       },
       {
         name: "hasChannel",
@@ -256,11 +257,11 @@ router.post(
  * @function
  */
 router.post(
-  "/custom/delete/:name",
+  "/custom/delete/:name?",
   isAdmin,
   error_catcher(async (req, res) => {
-    const { name } = req.params;
-
+    let { name } = req.params;
+    if (!name) name = "";
     const cevs = getState().getConfig("custom_events", []);
 
     await getState().setConfig(

package/routes/sync.js

@@ -24,9 +24,30 @@ router.get(
   })
 );
 
-const getSyncRows = async (syncInfo, table, syncUntil, client) => {
+const getSyncRows = async (syncInfo, table, syncUntil, client, user) => {
   const tblName = table.name;
   const pkName = table.pk_name;
+  const minRole = table.min_role_read;
+  const role = user?.role_id || 100;
+  let ownerFieldName = null;
+  if (
+    role > minRole &&
+    ((!table.ownership_field_id && !table.ownership_formula) || role === 100)
+  )
+    return null;
+  if (user?.id && role < 100 && role > minRole && table.ownership_field_id) {
+    const ownerField = table
+      .getFields()
+      .find((f) => f.id === table.ownership_field_id);
+    if (!ownerField) {
+      getState().log(
+        5,
+        `GET /load_changes: The ownership field of '${table.name}' does not exist.`
+      );
+      return null;
+    }
+    ownerFieldName = ownerField.name;
+  }
   const schema = db.getTenantSchemaPrefix();
   if (!syncInfo.syncFrom) {
     const { rows } = await client.query(
@@ -43,9 +64,9 @@ const getSyncRows = async (syncInfo, table, syncUntil, client) => {
       on info_tbl.ref = data_tbl."${db.sqlsanitize(
         pkName
       )}" and info_tbl.deleted = false
-      where data_tbl."${db.sqlsanitize(pkName)}" > ${
-        syncInfo.maxLoadedId
-      } order by data_tbl."${db.sqlsanitize(pkName)}"`
+      where data_tbl."${db.sqlsanitize(pkName)}" > ${syncInfo.maxLoadedId}
+      ${ownerFieldName ? `and data_tbl."${ownerFieldName}" = ${user.id}` : ""}
+      order by data_tbl."${db.sqlsanitize(pkName)}"`
     );
     for (const row of rows) {
       if (row._sync_info_tbl_last_modified_)
@@ -76,6 +97,7 @@ const getSyncRows = async (syncInfo, table, syncUntil, client) => {
       }) 
       and info_tbl.deleted = false
       and info_tbl.ref > ${syncInfo.maxLoadedId}
+      ${ownerFieldName ? `and data_tbl."${ownerFieldName}" = ${user.id}` : ""}
       order by info_tbl.ref`
     );
     for (const row of rows) {
@@ -114,7 +136,14 @@ router.post(
         const table = Table.findOne({ name: tblName });
         if (!table) throw new Error(`The table '${tblName}' does not exists`);
         const pkName = table.pk_name;
-        let rows = await getSyncRows(syncInfo, table, loadUntil, client);
+        let rows = await getSyncRows(
+          syncInfo,
+          table,
+          loadUntil,
+          client,
+          req.user
+        );
+        if (!rows) continue;
         if (role > table.min_role_read) {
           if (
             role === 100 ||

package/routes/tables.js

@@ -90,7 +90,7 @@ const tableForm = async (table, req) => {
     noSubmitButton: true,
     onChange: "saveAndContinue(this)",
     fields: [
-      ...(!table.external
+      ...(!table.external && !table.provider_name
         ? [
             {
               label: req.__("Ownership field"),
@@ -146,9 +146,9 @@ const tableForm = async (table, req) => {
         name: "min_role_read",
         input_type: "select",
         options: roleOptions,
-        attributes: { asideNext: !table.external },
+        attributes: { asideNext: !table.external && !table.provider_name },
       },
-      ...(table.external
+      ...(table.external || table.provider_name
         ? []
         : [
             {
@@ -790,6 +790,7 @@ router.get(
             "<br>"
           : "",
         !table.external &&
+          !table.provider_name &&
           a(
             {
               href: `/field/new/${table.id}`,
@@ -903,6 +904,7 @@ router.get(
         )
       ),
       !table.external &&
+        !table.provider_name &&
         div(
           { class: "mx-auto" },
           form(
@@ -929,6 +931,7 @@ router.get(
           )
         ),
       !table.external &&
+        !table.provider_name &&
         div(
           { class: "mx-auto" },
           a(
@@ -944,6 +947,7 @@ router.get(
 
       // only if table is not external
       !table.external &&
+        !table.provider_name &&
         div(
           { class: "mx-auto" },
           settingsDropdown(`dataMenuButton`, [

package/tests/api.test.js

@@ -127,6 +127,22 @@ describe("API read", () => {
       .set("Cookie", loginCookie)
       .expect(succeedJsonWith((rows) => rows.length == 2));
   });
+  it("should dereference", async () => {
+    const loginCookie = await getStaffLoginCookie();
+
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .get("/api/patients/?dereference=favbook")
+      .set("Cookie", loginCookie)
+      .expect(
+        succeedJsonWith(
+          (rows) =>
+            rows.length == 2 &&
+            rows.find((r) => r.favbook === 1).favbook_author ==
+              "Herman Melville"
+        )
+      );
+  });
   it("should add version counts", async () => {
     const patients = Table.findOne({ name: "patients" });
     await patients.update({ versioned: true });

package/tests/sync.test.js

@@ -10,6 +10,8 @@ const db = require("@saltcorn/data/db");
 const { sleep } = require("@saltcorn/data/tests/mocks");
 
 const Table = require("@saltcorn/data/models/table");
+const Field = require("@saltcorn/data/models/field");
+const User = require("@saltcorn/data/models/user");
 
 beforeAll(async () => {
   await resetToFixtures();
@@ -32,7 +34,7 @@ const initSyncInfo = async (tbls) => {
 describe("load remote insert/updates", () => {
   if (!db.isSQLite) {
     beforeAll(async () => {
-      await initSyncInfo(["books", "publisher"]);
+      await initSyncInfo(["books", "publisher", "patients"]);
     });
     it("check params", async () => {
       const app = await getApp({ disableCsrf: true });
@@ -178,6 +180,99 @@ describe("load remote insert/updates", () => {
         expect(data.books.rows[1].author).toBe("Leo Tolstoy");
       }
     });
+
+    it("load sync not authorized", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getUserLoginCookie();
+      const loadUntil = new Date();
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            patients: {
+              maxLoadedId: 0,
+              syncFrom: 1000,
+            },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const data = resp._body;
+      expect(Object.keys(data).length).toBe(0);
+    });
+
+    const addOwnerField = async () => {
+      const patients = Table.findOne({ name: "patients" });
+      const users = Table.findOne({ name: "users" });
+      const ownerField = await Field.create({
+        table: patients,
+        name: "owner",
+        label: "Pages",
+        type: "Key",
+        reftable: users,
+        attributes: { summary_field: "id" },
+      });
+      patients.ownership_field_id = ownerField.id;
+      await patients.update(patients);
+      const user = await User.findOne({ email: "user@foo.com" });
+      await patients.updateRow({ owner: user.id }, 1);
+    };
+
+    it("load sync authorized with ownership", async () => {
+      await addOwnerField();
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getUserLoginCookie();
+      const loadUntil = new Date();
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            patients: {
+              maxLoadedId: 0,
+            },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const data = resp._body;
+      expect(Object.keys(data).length).toBe(1);
+      expect(data.patients).toBeDefined();
+      expect(data.patients.rows.length).toBe(1);
+      expect(data.patients.rows[0].id).toBe(1);
+    });
+
+    it("load sync authorized with ownership and syncFrom", async () => {
+      const patients = Table.findOne({ name: "patients" });
+      if (!patients.ownership_field_id) await addOwnerField();
+      const rows = await patients.getRows();
+      for (const row of rows) {
+        await patients.updateRow(row, row.id);
+      }
+
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getUserLoginCookie();
+      const loadUntil = new Date();
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            patients: {
+              maxLoadedId: 0,
+              syncFrom: 1000,
+            },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const data = resp._body;
+      expect(Object.keys(data).length).toBe(1);
+      expect(data.patients).toBeDefined();
+      expect(data.patients.rows.length).toBe(1);
+      expect(data.patients.rows[0].id).toBe(1);
+    });
   } else
     it("only pq support", () => {
       expect(true).toBe(true);

package/tests/view.test.js

@@ -9,13 +9,12 @@ const {
   toNotInclude,
   resetToFixtures,
   respondJsonWith,
+  toSucceed,
 } = require("../auth/testhelp");
 const db = require("@saltcorn/data/db");
 const { getState } = require("@saltcorn/data/db/state");
 const View = require("@saltcorn/data/models/view");
 const Table = require("@saltcorn/data/models/table");
-const Trigger = require("@saltcorn/data/models/trigger");
-const Page = require("@saltcorn/data/models/page");
 
 const { plugin_with_routes } = require("@saltcorn/data/tests/mocks");
 
@@ -397,6 +396,70 @@ describe("action row_variable", () => {
   });
 });
 
+describe("update matching rows", () => {
+  const updateMatchingRows = async ({ query, body }) => {
+    const app = await getApp({ disableCsrf: true });
+    const loginCookie = await getAdminLoginCookie();
+    await request(app)
+      .post(
+        `/view/author_multi_edit/update_matching_rows${
+          query ? `?${query}` : ""
+        }`
+      )
+      .set("Cookie", loginCookie)
+      .send(body)
+      .set("Content-Type", "application/json")
+      .set("Accept", "application/json")
+      .expect(toSucceed(302));
+  };
+
+  beforeAll(async () => {
+    const table = Table.findOne({ name: "books" });
+    const field = table.getFields().find((f) => f.name === "author");
+    await field.update({ is_unique: false });
+  });
+
+  it("update matching books normal", async () => {
+    const table = Table.findOne({ name: "books" });
+    await updateMatchingRows({
+      query: "author=leo&publisher=1",
+      body: { author: "new_author" },
+    });
+    let actualRows = await table.getRows({ author: "new_author" });
+    expect(actualRows.length).toBe(1);
+    await updateMatchingRows({
+      query: "_gte_pages=600",
+      body: { author: "more_than" },
+    });
+    actualRows = await table.getRows({ author: "more_than" });
+    expect(actualRows.length >= 2).toBe(true);
+    const expected = (await table.getRows()).map((row) => {
+      return { id: row.id, author: "agi", pages: 100, publisher: null };
+    });
+    await updateMatchingRows({
+      body: { author: "agi", pages: 100, publisher: null },
+    });
+    actualRows = await table.getRows({});
+    expect(actualRows).toEqual(expected);
+  });
+
+  it("update matching books with edit-in-edit", async () => {
+    const disBooks = Table.findOne({ name: "discusses_books" });
+    await updateMatchingRows({
+      query: "id=2",
+      body: { author: "Leo Tolstoy" },
+    });
+    await updateMatchingRows({
+      query: "author=leo",
+      body: { author: "agi", discussant_0: "1", discussant_1: "2" },
+    });
+    const discBooksRows = (await disBooks.getRows({ book: 2 })).filter(
+      ({ discussant }) => discussant === 1 || discussant === 2
+    );
+    expect(discBooksRows.length).toBe(2);
+  });
+});
+
 describe("inbound relations", () => {
   it("view with inbound relation", async () => {
     const app = await getApp({ disableCsrf: true });