@saltcorn/server 1.1.1-beta.5 → 1.1.1-beta.6

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## 1.1.1 - In beta
 
+* You can now permit to non-admin (role ID > 1) users to edit or inspect tables, or 
+  edit views, pages or triggers. In the permissions tab of the Users and security
+  settings, minimum roles can be set for these capabilities. The appropriate
+  menu items will be added to any users with the roles that match these permissions. 
+
 * Stored calculated fields that contain joinfields in the expression are now automatically 
   updated when the values they reference are changed, i.e. changes occur in the tables they
   reference. This is limited to single (expression contains x.y) and double joinfields 
@@ -34,6 +39,7 @@
 
 ### Fixes
 
+* fix workflows on SQLite
 * fix query string build on check_state_field (#2948). Author: St0rml
 
 ### Translations

package/auth/admin.js

@@ -414,6 +414,14 @@ const permissions_settings_form = async (req) =>
       "min_role_upload",
       "min_role_apikeygen",
       "min_role_search",
+      {
+        section_header: req.__("Development permissions"),
+      },
+      "min_role_inspect_tables",
+      "min_role_edit_tables",
+      "min_role_edit_views",
+      "min_role_edit_pages",
+      "min_role_edit_triggers",
       //hidden            "exttables_min_role_read",
     ],
     action: "/useradmin/permissions",

package/locales/en.json

@@ -1528,5 +1528,20 @@
 	"Finished": "Finished",
 	"Error": "Error",
 	"Waiting": "Waiting",
-	"Running": "Running"
+	"Running": "Running",
+	"Minimum role to access search page": "Minimum role to access search page",
+	"Edit tables": "Edit tables",
+	"Minimum role to edit tables": "Minimum role to edit tables",
+	"Edit views": "Edit views",
+	"Minimum role to edit views": "Minimum role to edit views",
+	"Edit pages": "Edit pages",
+	"Minimum role to edit pages": "Minimum role to edit pages",
+	"Edit triggers": "Edit triggers",
+	"Minimum role to edit triggers": "Minimum role to edit triggers",
+	"Development permissions": "Development permissions",
+	"Inspect tables": "Inspect tables",
+	"Minimum role to inspect (see, without editing) tables": "Minimum role to inspect (see, without editing) tables",
+	"Home pages": "Home pages",
+	"The home page is the page that is served when the user visits the home location (/). This can be set for each user role.": "The home page is the page that is served when the user visits the home location (/). This can be set for each user role.",
+	"Trigger %s deleted": "Trigger %s deleted"
 }

package/markup/admin.js

@@ -302,14 +302,19 @@ const send_tags_page = (args) => {
  */
 const send_events_page = (args) => {
   const isRoot = db.getTenantSchema() === db.connectObj.default_schema;
+  const isUserAdmin = args.req?.user.role_id === 1;
   return send_settings_page({
     main_section: "Events",
     main_section_href: "/events",
     sub_sections: [
       { text: "Triggers", href: "/actions" },
-      { text: "Custom", href: "/eventlog/custom" },
-      { text: "Settings", href: "/eventlog/settings" },
-      { text: "Event log", href: "/eventlog" },
+      ...(isUserAdmin
+        ? [
+            { text: "Custom", href: "/eventlog/custom" },
+            { text: "Settings", href: "/eventlog/settings" },
+            { text: "Event log", href: "/eventlog" },
+          ]
+        : []),
       { text: "Workflow runs", href: "/actions/runs" },
       ...(isRoot ? [{ text: "Crash log", href: "/crashlog" }] : []),
     ],

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@saltcorn/server",
-  "version": "1.1.1-beta.5",
+  "version": "1.1.1-beta.6",
   "description": "Server app for Saltcorn, open-source no-code platform",
   "homepage": "https://saltcorn.com",
   "main": "index.js",
   "license": "MIT",
   "dependencies": {
     "@aws-sdk/client-s3": "^3.451.0",
-    "@saltcorn/base-plugin": "1.1.1-beta.5",
-    "@saltcorn/builder": "1.1.1-beta.5",
-    "@saltcorn/data": "1.1.1-beta.5",
-    "@saltcorn/admin-models": "1.1.1-beta.5",
-    "@saltcorn/filemanager": "1.1.1-beta.5",
-    "@saltcorn/markup": "1.1.1-beta.5",
-    "@saltcorn/plugins-loader": "1.1.1-beta.5",
-    "@saltcorn/sbadmin2": "1.1.1-beta.5",
+    "@saltcorn/base-plugin": "1.1.1-beta.6",
+    "@saltcorn/builder": "1.1.1-beta.6",
+    "@saltcorn/data": "1.1.1-beta.6",
+    "@saltcorn/admin-models": "1.1.1-beta.6",
+    "@saltcorn/filemanager": "1.1.1-beta.6",
+    "@saltcorn/markup": "1.1.1-beta.6",
+    "@saltcorn/plugins-loader": "1.1.1-beta.6",
+    "@saltcorn/sbadmin2": "1.1.1-beta.6",
     "@socket.io/cluster-adapter": "^0.2.1",
     "@socket.io/sticky": "^1.0.1",
     "adm-zip": "0.5.10",

package/public/saltcorn-common.js

@@ -139,6 +139,9 @@ function valid_js_var_name(s) {
   if (!s) return false;
   return !!s.match(/^[a-zA-Z_$][a-zA-Z_$0-9]*$/);
 }
+
+const apply_showif_fetching_urls = new Set();
+
 function apply_showif() {
   const isNode = getIsNode();
   $("[data-show-if]").each(function (ix, element) {
@@ -358,6 +361,7 @@ function apply_showif() {
         ...cache,
         [qs]: "fetching",
       });
+      apply_showif_fetching_urls.add(`/api/${dynwhere.table}?${qs}`);
       $.ajax(`/api/${dynwhere.table}?${qs}`)
         .then((resp) => {
           if (resp.success) {
@@ -378,7 +382,10 @@ function apply_showif() {
             });
           }
         })
-        .fail(checkNetworkError);
+        .fail(checkNetworkError)
+        .always(() => {
+          apply_showif_fetching_urls.delete(`/api/${dynwhere.table}?${qs}`);
+        });
     }
   });
   $("[data-filter-table]").each(function (ix, element) {

package/public/saltcorn.js

@@ -459,6 +459,18 @@ function saveAndContinueIfValid(e, k, event) {
   });
 }
 
+function saveAndContinueDelayed(e, k, event, retries = 1) {
+  //wait for applyShowIf
+  setTimeout(() => {
+    if (apply_showif_fetching_urls.size > 0 && retries < 5) {
+      setTimeout(() => {
+        saveAndContinueDelayed(e, k, event, retries + 1);
+      }, 200);
+    } else saveAndContinue(e, k, event);
+  });
+  return false;
+}
+
 function saveAndContinue(e, k, event) {
   if (
     event &&

package/routes/actions.js

@@ -7,6 +7,7 @@
 const Router = require("express-promise-router");
 const {
   isAdmin,
+  isAdminOrHasConfigMinRole,
   error_catcher,
   addOnDoneRedirect,
   is_relative_url,
@@ -85,7 +86,7 @@ const {
  */
 router.get(
   "/",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     let triggers = await Trigger.findAllWithTableName();
     let filterOnTag;
@@ -347,7 +348,7 @@ const triggerForm = async (req, trigger) => {
  */
 router.get(
   "/new",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const form = await triggerForm(req);
     if (req.query.table) {
@@ -388,7 +389,7 @@ router.get(
  */
 router.get(
   "/edit/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const trigger = await Trigger.findOne({ id });
@@ -419,7 +420,7 @@ router.get(
  */
 router.post(
   "/new",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const form = await triggerForm(req);
 
@@ -462,7 +463,7 @@ router.post(
  */
 router.post(
   "/edit/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const trigger = await Trigger.findOne({ id });
@@ -928,7 +929,7 @@ const getMultiStepForm = async (req, id, table) => {
  */
 router.get(
   "/configure/:idorname",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { idorname } = req.params;
     let trigger;
@@ -1130,7 +1131,7 @@ router.get(
  */
 router.post(
   "/configure/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const trigger = await Trigger.findOne({ id });
@@ -1202,7 +1203,7 @@ router.post(
  */
 router.post(
   "/delete/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const trigger = await Trigger.findOne({ id });
@@ -1211,6 +1212,7 @@ router.post(
       entity_name: trigger.name,
     });
     await trigger.delete();
+    req.flash("success", req.__(`Trigger %s deleted`, trigger.name));
     res.redirect(`/actions/`);
   })
 );
@@ -1222,7 +1224,7 @@ router.post(
  */
 router.get(
   "/testrun/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const trigger = await Trigger.findOne({ id });
@@ -1333,7 +1335,7 @@ router.get(
  */
 router.post(
   "/clone/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const trig = await Trigger.findOne({ id });
@@ -1358,7 +1360,7 @@ router.post(
  */
 router.get(
   "/stepedit/:trigger_id/:step_id?",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { trigger_id, step_id } = req.params;
     const { initial_step, after_step, before_step } = req.query;
@@ -1400,7 +1402,7 @@ router.get(
 
 router.post(
   "/stepedit/:trigger_id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { trigger_id } = req.params;
     const trigger = await Trigger.findOne({ id: trigger_id });
@@ -1499,7 +1501,7 @@ router.post(
 
 router.post(
   "/gen-copilot/:trigger_id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { trigger_id } = req.params;
     const trigger = await Trigger.findOne({ id: trigger_id });
@@ -1525,18 +1527,18 @@ router.post(
 
 router.post(
   "/delete-step/:step_id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { step_id } = req.params;
     const step = await WorkflowStep.findOne({ id: step_id });
-    await step.delete();
+    await step.delete(true);
     res.json({ goto: `/actions/configure/${step.trigger_id}` });
   })
 );
 
 router.get(
   "/runs",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const trNames = {};
     const { _page, trigger } = req.query;
@@ -1607,7 +1609,7 @@ router.get(
 
 router.get(
   "/run/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
 
@@ -1730,7 +1732,7 @@ router.get(
 
 router.post(
   "/delete-run/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
 

package/routes/admin.js

@@ -13,6 +13,7 @@ const {
   admin_config_route,
   get_sys_info,
   tenant_letsencrypt_name,
+  isAdminOrHasConfigMinRole,
 } = require("./utils.js");
 const Table = require("@saltcorn/data/models/table");
 const Plugin = require("@saltcorn/data/models/plugin");
@@ -295,7 +296,7 @@ router.get(
   error_catcher(async (req, res) => {
     const fp = path.join(__dirname, "..", "CHANGELOG.md");
     const fileBuf = await fs.promises.readFile(fp);
-    const mdContents = fileBuf.toString().replace("# Notable changes\n","");
+    const mdContents = fileBuf.toString().replace("# Notable changes\n", "");
     const markup = md.render(mdContents);
     res.sendWrap(`What's new in Saltcorn`, { above: [markup] });
   })
@@ -626,13 +627,36 @@ router.get(
   })
 );
 
+const checkEditPermission = (type, user) => {
+  if (user.role_id === 1) return true;
+  switch (type) {
+    case "view":
+      return getState().getConfig("min_role_edit_views", 1) >= user.role_id;
+    case "page":
+      return getState().getConfig("min_role_edit_pages", 1) >= user.role_id;
+    case "trigger":
+      return getState().getConfig("min_role_edit_triggers", 1) >= user.role_id;
+    default:
+      return false;
+  }
+};
+
 router.get(
   "/snapshot-restore/:type/:name",
-  isAdmin,
+  isAdminOrHasConfigMinRole([
+    "min_role_edit_views",
+    "min_role_edit_pages",
+    "min_role_edit_triggers",
+  ]),
   error_catcher(async (req, res) => {
     const { type, name } = req.params;
     const snaps = await Snapshot.entity_history(type, name);
     const locale = getState().getConfig("default_locale", "en");
+    const auth = checkEditPermission(type, req.user);
+    if (!auth) {
+      res.send("Not authorized");
+      return;
+    }
     res.set("Page-Title", `Restore ${text(name)}`);
     res.send(
       mkTable(
@@ -663,17 +687,26 @@ router.get(
 
 router.post(
   "/snapshot-restore/:type/:name/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole([
+    "min_role_edit_views",
+    "min_role_edit_pages",
+    "min_role_edit_triggers",
+  ]),
   error_catcher(async (req, res) => {
     const { type, name, id } = req.params;
-    const snap = await Snapshot.findOne({ id });
-    await snap.restore_entity(type, name);
-    req.flash(
-      "success",
-      `${type} ${name} restored to snapshot saved ${moment(
-        snap.created
-      ).fromNow()}`
-    );
+    const auth = checkEditPermission(type, req.user);
+    if (!auth) {
+      req.flash("error", "Not authorized");
+    } else {
+      const snap = await Snapshot.findOne({ id });
+      await snap.restore_entity(type, name);
+      req.flash(
+        "success",
+        `${type} ${name} restored to snapshot saved ${moment(
+          snap.created
+        ).fromNow()}`
+      );
+    }
     res.redirect(
       type === "trigger"
         ? `/actions`
@@ -2414,7 +2447,7 @@ router.get(
                         class: "form-control",
                         name: "appId",
                         id: "appIdInputId",
-                        placeholder: "com.saltcorn.app",
+                        placeholder: "com.saltcorn.mobile.app",
                         value: builderSettings.appId || "",
                       })
                     )
@@ -3114,49 +3147,48 @@ router.get(
                             ].join("")
                           )
                         )
-                      )
+                      ),
                       // Share Extension provisioning profile
-                      // disabled for now
-                      // div(
-                      //   { class: "row pb-3" },
-                      //   div(
-                      //     { class: "col-sm-8" },
-                      //     label(
-                      //       {
-                      //         for: "shareProvisioningProfileInputId",
-                      //         class: "form-label fw-bold",
-                      //       },
-                      //       req.__("Share Extension Provisioning Profile"),
-                      //       a(
-                      //         {
-                      //           href: "javascript:ajax_modal('/admin/help/Provisioning Profile?')",
-                      //         },
-                      //         i({ class: "fas fa-question-circle ps-1" })
-                      //       )
-                      //     ),
-                      //     select(
-                      //       {
-                      //         class: "form-select",
-                      //         name: "shareProvisioningProfile",
-                      //         id: "shareProvisioningProfileInputId",
-                      //       },
-                      //       [
-                      //         option({ value: "" }, ""),
-                      //         ...provisioningFiles.map((file) =>
-                      //           option(
-                      //             {
-                      //               value: file.location,
-                      //               selected:
-                      //                 builderSettings.shareProvisioningProfile ===
-                      //                 file.location,
-                      //             },
-                      //             file.filename
-                      //           )
-                      //         ),
-                      //       ].join("")
-                      //     )
-                      //   )
-                      // )
+                      div(
+                        { class: "row pb-3" },
+                        div(
+                          { class: "col-sm-8" },
+                          label(
+                            {
+                              for: "shareProvisioningProfileInputId",
+                              class: "form-label fw-bold",
+                            },
+                            req.__("Share Extension Provisioning Profile"),
+                            a(
+                              {
+                                href: "javascript:ajax_modal('/admin/help/Provisioning Profile?')",
+                              },
+                              i({ class: "fas fa-question-circle ps-1" })
+                            )
+                          ),
+                          select(
+                            {
+                              class: "form-select",
+                              name: "shareProvisioningProfile",
+                              id: "shareProvisioningProfileInputId",
+                            },
+                            [
+                              option({ value: "" }, ""),
+                              ...provisioningFiles.map((file) =>
+                                option(
+                                  {
+                                    value: file.location,
+                                    selected:
+                                      builderSettings.shareProvisioningProfile ===
+                                      file.location,
+                                  },
+                                  file.filename
+                                )
+                              ),
+                            ].join("")
+                          )
+                        )
+                      )
                     )
                   )
                 ),
@@ -3425,11 +3457,10 @@ router.post(
       keystoreAlias,
       keystorePassword,
     } = req.body;
-    // const receiveShareTriggers = Trigger.find({
-    //   when_trigger: "ReceiveMobileShareData",
-    // });
-    // disabeling share to support for now
-    let allowShareTo = false; // receiveShareTriggers.length > 0;
+    const receiveShareTriggers = Trigger.find({
+      when_trigger: "ReceiveMobileShareData",
+    });
+    let allowShareTo = receiveShareTriggers.length > 0;
     if (allowShareTo && iOSPlatform && !shareProvisioningProfile) {
       allowShareTo = false;
       msgs.push({
@@ -4191,10 +4222,6 @@ admin_config_route({
     { section_header: "Progressive Web Application" },
     "pwa_enabled",
     { name: "pwa_display", showIf: { pwa_enabled: true } },
-    {
-      name: "pwa_share_to_enabled",
-      showIf: { pwa_enabled: true },
-    },
     { name: "pwa_set_colors", showIf: { pwa_enabled: true } },
     {
       name: "pwa_theme_color",

package/routes/common_lists.js

@@ -12,6 +12,7 @@ const {
   badge,
 } = require("@saltcorn/markup");
 const { get_base_url } = require("./utils.js");
+const { getState } = require("@saltcorn/data/db/state");
 const { h4, p, div, a, i, text, span, nbsp } = require("@saltcorn/markup/tags");
 
 /**
@@ -57,7 +58,9 @@ const tablesList = async (
   });
   const tagsById = {};
   tags.forEach((t) => (tagsById[t.id] = t));
-
+  const user_can_edit_tables =
+    req.user.role_id === 1 ||
+    getState().getConfig("min_role_edit_tables", 1) >= req.user.role_id;
   const tagBadges = (table) => {
     const myTags = tag_entries.filter((te) => te.table_id === table.id);
     return myTags
@@ -95,23 +98,27 @@ const tablesList = async (
               ? `${getRole(t.min_role_read)} (read only)`
               : `${getRole(t.min_role_read)}/${getRole(t.min_role_write)}`,
         },
-        !tagId
-          ? {
-              label: req.__("Delete"),
-              key: (r) =>
-                r.name === "users" || r.external
-                  ? ""
-                  : post_delete_btn(`/table/delete/${r.id}`, req, r.name),
-            }
-          : {
-              label: req.__("Remove From Tag"),
-              key: (r) =>
-                post_delete_btn(
-                  `/tag-entries/remove/tables/${r.id}/${tagId}`,
-                  req,
-                  `${r.name} from this tag`
-                ),
-            },
+        ...(user_can_edit_tables
+          ? [
+              !tagId
+                ? {
+                    label: req.__("Delete"),
+                    key: (r) =>
+                      r.name === "users" || r.external
+                        ? ""
+                        : post_delete_btn(`/table/delete/${r.id}`, req, r.name),
+                  }
+                : {
+                    label: req.__("Remove From Tag"),
+                    key: (r) =>
+                      post_delete_btn(
+                        `/tag-entries/remove/tables/${r.id}/${tagId}`,
+                        req,
+                        `${r.name} from this tag`
+                      ),
+                  },
+            ]
+          : []),
       ],
       tables,
       {
@@ -286,6 +293,10 @@ const viewsList = async (
   });
   const tagsById = {};
   tags.forEach((t) => (tagsById[t.id] = t));
+  const user_can_inspect_tables =
+    req.user.role_id === 1 ||
+    getState().getConfig("min_role_edit_tables", 1) >= req.user.role_id ||
+    getState().getConfig("min_role_inspect_tables", 1) >= req.user.role_id;
 
   const tagBadges = (view) => {
     const myTags = tag_entries.filter((te) => te.view_id === view.id);
@@ -339,7 +350,10 @@ const viewsList = async (
           : [
               {
                 label: req.__("Table"),
-                key: (r) => link(`/table/${r.table}`, r.table),
+                key: (r) =>
+                  user_can_inspect_tables
+                    ? link(`/table/${r.table}`, r.table)
+                    : r.table,
                 sortlink: !tagId
                   ? `set_state_field('_sortby', 'table', this)`
                   : undefined,
@@ -634,6 +648,10 @@ const getTriggerList = async (
   });
   const tagsById = {};
   tags.forEach((t) => (tagsById[t.id] = t));
+  const user_can_inspect_tables =
+    req.user.role_id === 1 ||
+    getState().getConfig("min_role_edit_tables", 1) >= req.user.role_id ||
+    getState().getConfig("min_role_inspect_tables", 1) >= req.user.role_id;
 
   const tagBadges = (trigger) => {
     const myTags = tag_entries.filter((te) => te.trigger_id === trigger.id);
@@ -682,7 +700,9 @@ const getTriggerList = async (
         label: req.__("Table or Channel"),
         key: (r) =>
           r.table_name
-            ? a({ href: `/table/${r.table_name}` }, r.table_name)
+            ? user_can_inspect_tables
+              ? a({ href: `/table/${r.table_name}` }, r.table_name)
+              : r.table_name
             : r.channel,
       },
       !tagId