@saltcorn/server 1.0.0-rc.6 → 1.0.0-rc.7

package/locales/en.json

@@ -1476,5 +1476,6 @@
 	"clean node_modules": "clean node_modules",
 	"After delete": "After delete",
 	"Search only on exact match, not substring match. Useful for large tables": "Search only on exact match, not substring match. Useful for large tables",
-	"Please select an entry point.": "Please select an entry point."
+	"Please select an entry point.": "Please select an entry point.",
+	"Group by": "Group by"
 }

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@saltcorn/server",
-  "version": "1.0.0-rc.6",
+  "version": "1.0.0-rc.7",
   "description": "Server app for Saltcorn, open-source no-code platform",
   "homepage": "https://saltcorn.com",
   "main": "index.js",
   "license": "MIT",
   "dependencies": {
     "@aws-sdk/client-s3": "^3.451.0",
-    "@saltcorn/base-plugin": "1.0.0-rc.6",
-    "@saltcorn/builder": "1.0.0-rc.6",
-    "@saltcorn/data": "1.0.0-rc.6",
-    "@saltcorn/admin-models": "1.0.0-rc.6",
-    "@saltcorn/filemanager": "1.0.0-rc.6",
-    "@saltcorn/markup": "1.0.0-rc.6",
-    "@saltcorn/plugins-loader": "1.0.0-rc.6",
-    "@saltcorn/sbadmin2": "1.0.0-rc.6",
+    "@saltcorn/base-plugin": "1.0.0-rc.7",
+    "@saltcorn/builder": "1.0.0-rc.7",
+    "@saltcorn/data": "1.0.0-rc.7",
+    "@saltcorn/admin-models": "1.0.0-rc.7",
+    "@saltcorn/filemanager": "1.0.0-rc.7",
+    "@saltcorn/markup": "1.0.0-rc.7",
+    "@saltcorn/plugins-loader": "1.0.0-rc.7",
+    "@saltcorn/sbadmin2": "1.0.0-rc.7",
     "@socket.io/cluster-adapter": "^0.2.1",
     "@socket.io/sticky": "^1.0.1",
     "adm-zip": "0.5.10",

package/routes/api.js

@@ -27,6 +27,7 @@ const Table = require("@saltcorn/data/models/table");
 const View = require("@saltcorn/data/models/view");
 //const Field = require("@saltcorn/data/models/field");
 const Trigger = require("@saltcorn/data/models/trigger");
+const File = require("@saltcorn/data/models/file");
 //const load_plugins = require("../load_plugins");
 const passport = require("passport");
 
@@ -189,6 +190,39 @@ router.post(
     )(req, res, next);
   })
 );
+
+router.get(
+  "/serve-files/*",
+  //passport.authenticate("api-bearer", { session: false }),
+  error_catcher(async (req, res, next) => {
+    await passport.authenticate(
+      "api-bearer",
+      { session: false },
+      async function (err, user, info) {
+        const role = req?.user?.role_id || user?.role_id || 100;
+        const user_id = req?.user?.id || user?.id;
+        const serve_path = req.params[0];
+        const file = await File.findOne(serve_path);
+        if (
+          file &&
+          (role <= file.min_role_read || (user_id && user_id === file.user_id))
+        ) {
+          res.type(file.mimetype);
+          const cacheability =
+            file.min_role_read === 100 ? "public" : "private";
+          const maxAge = getState().getConfig("files_cache_maxage", 86400);
+          res.set("Cache-Control", `${cacheability}, max-age=${maxAge}`);
+          if (file.s3_store)
+            res.status(404).json({ error: req.__("Not found") });
+          else res.sendFile(file.location);
+        } else {
+          res.status(404).json({ error: req.__("Not found") });
+        }
+      }
+    )(req, res, next);
+  })
+);
+
 /**
  *
  */

package/tests/api.test.js

@@ -2,6 +2,8 @@ const request = require("supertest");
 const getApp = require("../app");
 const Table = require("@saltcorn/data/models/table");
 const Trigger = require("@saltcorn/data/models/trigger");
+const File = require("@saltcorn/data/models/file");
+const fs = require("fs").promises;
 
 const Field = require("@saltcorn/data/models/field");
 const {
@@ -19,6 +21,19 @@ const User = require("@saltcorn/data/models/user");
 
 beforeAll(async () => {
   await resetToFixtures();
+  await File.ensure_file_store();
+  await File.from_req_files(
+    {
+      mimetype: "image/png",
+      name: "rick1.png",
+      mv: async (fnm) => {
+        await fs.writeFile(fnm, "nevergonnagiveyouup");
+      },
+      size: 245752,
+    },
+    1,
+    80
+  );
 });
 afterAll(db.close);
 
@@ -352,6 +367,20 @@ describe("API authentication", () => {
 
       .expect(succeedJsonWith((rows) => rows.length == 2));
   });
+  it("should not show file to public", async () => {
+    const app = await getApp();
+    await request(app)
+      .get("/api/serve-files/rick1.png")
+      .expect(respondJsonWith(404, (b) => b.error === "Not found"));
+  });
+  it("should show file to user", async () => {
+    const app = await getApp();
+    const u = await User.findOne({ id: 1 });
+    await request(app)
+      .get("/api/serve-files/rick1.png")
+      .set("Authorization", "Bearer " + u.api_token)
+      .expect(200);
+  });
 });
 
 describe("API action", () => {