@saltcorn/server 1.1.2-beta.11 → 1.1.2-beta.13

package/CHANGELOG.md

@@ -15,6 +15,14 @@
 
 * Upgrade a large number of dependencies (express, typescript, oclif, pg, webpack, typescript, axios, mjml, svelte). Node.js 18+ is require for this release. 
 
+### Security
+
+* View roles are now strictly enforced, including when views are embedded.
+
+### Fixes
+
+* Much work on primary keys not called "id"
+
 ## 1.1.1 - Released 2 February 2025
 
 * Full-text search improvements: 

package/locales/en.json

@@ -1553,5 +1553,6 @@
 	"Search syntax help": "Search syntax help",
 	"Search syntax": "Search syntax",
 	"Maximum role": "Maximum role",
-	"Module dependencies": "Module dependencies"
+	"Module dependencies": "Module dependencies",
+	"Prompt": "Prompt"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saltcorn/server",
-  "version": "1.1.2-beta.11",
+  "version": "1.1.2-beta.13",
   "description": "Server app for Saltcorn, open-source no-code platform",
   "homepage": "https://saltcorn.com",
   "main": "index.js",
@@ -8,14 +8,14 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.735.0",
     "@dr.pogodin/csurf": "^1.14.1",
-    "@saltcorn/base-plugin": "1.1.2-beta.11",
-    "@saltcorn/builder": "1.1.2-beta.11",
-    "@saltcorn/data": "1.1.2-beta.11",
-    "@saltcorn/admin-models": "1.1.2-beta.11",
-    "@saltcorn/filemanager": "1.1.2-beta.11",
-    "@saltcorn/markup": "1.1.2-beta.11",
-    "@saltcorn/plugins-loader": "1.1.2-beta.11",
-    "@saltcorn/sbadmin2": "1.1.2-beta.11",
+    "@saltcorn/base-plugin": "1.1.2-beta.13",
+    "@saltcorn/builder": "1.1.2-beta.13",
+    "@saltcorn/data": "1.1.2-beta.13",
+    "@saltcorn/admin-models": "1.1.2-beta.13",
+    "@saltcorn/filemanager": "1.1.2-beta.13",
+    "@saltcorn/markup": "1.1.2-beta.13",
+    "@saltcorn/plugins-loader": "1.1.2-beta.13",
+    "@saltcorn/sbadmin2": "1.1.2-beta.13",
     "@socket.io/cluster-adapter": "^0.2.1",
     "@socket.io/sticky": "^1.0.1",
     "adm-zip": "0.5.16",

package/routes/actions.js

@@ -653,7 +653,7 @@ const getWorkflowStepForm = async (
               ...(field.showIf || {}),
             },
           };
-        if (cfgFld.input_type === "code") cfgFld.input_type = "textarea";
+        //if (cfgFld.input_type === "code") cfgFld.input_type = "textarea";
         actionConfigFields.push(cfgFld);
       }
     } catch {}
@@ -1854,7 +1854,6 @@ interactive workflows for not logged in
 actions can declare which variables they inject into scope
 
 show unconnected steps
-why is code not initialising
 drag and drop edges
 
 */

package/routes/admin.js

@@ -709,8 +709,8 @@ router.post(
       type === "trigger"
         ? `/actions`
         : /^[a-z]+$/g.test(type)
-        ? `/${type}edit`
-        : "/"
+          ? `/${type}edit`
+          : "/"
     );
   })
 );
@@ -1195,7 +1195,7 @@ router.get(
                     th({ valign: "top" }, req.__("Saltcorn version")),
                     td(
                       packagejson.version,
-                      isRoot 
+                      isRoot && can_update
                         ? post_btn(
                             "/admin/upgrade",
                             req.__("Upgrade") + " (latest)",
@@ -1206,21 +1206,22 @@ router.get(
                             }
                           )
                         : isRoot && is_latest
-                        ? span(
-                            { class: "badge bg-primary ms-2" },
-                            req.__("Latest")
-                          ) +
-                          post_btn(
-                            "/admin/check-for-upgrade",
-                            req.__("Check updates"),
-                            req.csrfToken(),
-                            {
-                              btnClass: "btn-primary btn-sm px-1 py-0",
-                              formClass: "d-inline",
-                            }
-                          )
-                        : "",
-                      !git_commit &&
+                          ? span(
+                              { class: "badge bg-primary ms-2" },
+                              req.__("Latest")
+                            ) +
+                            post_btn(
+                              "/admin/check-for-upgrade",
+                              req.__("Check updates"),
+                              req.csrfToken(),
+                              {
+                                btnClass: "btn-primary btn-sm px-1 py-0",
+                                formClass: "d-inline",
+                              }
+                            )
+                          : "",
+                      isRoot &&
+                        !git_commit &&
                         a(
                           {
                             id: rndid,
@@ -1563,21 +1564,30 @@ const cleanNodeModules = async () => {
 };
 
 const doInstall = async (req, res, version, deepClean, runPull) => {
+  const state = getState();
+  let res_write = (s) => {
+    try {
+      res.write(s);
+      state.log(5, s);
+    } catch (e) {
+      console.error("Install write error: ", e?.message || e);
+    }
+  };
   if (db.getTenantSchema() !== db.connectObj.default_schema) {
     req.flash("error", req.__("Not possible for tenant"));
     res.redirect("/admin");
   } else {
-    res.write(
+    res_write(
       version === "latest"
         ? req.__("Starting upgrade, please wait...\n")
         : req.__("Installing %s, please wait...\n", version)
     );
     if (deepClean) {
-      res.write(req.__("Cleaning node_modules...\n"));
+      res_write(req.__("Cleaning node_modules...\n"));
       try {
         await cleanNodeModules();
       } catch (e) {
-        res.write(req.__("Error cleaning node_modules: %s\n", e.message));
+        res_write(req.__("Error cleaning node_modules: %s\n", e.message));
       }
     }
     const child = spawn(
@@ -1588,33 +1598,37 @@ const doInstall = async (req, res, version, deepClean, runPull) => {
       }
     );
     child.stdout.on("data", (data) => {
-      res.write(data);
+      res_write(data);
     });
     child.stderr?.on("data", (data) => {
-      res.write(data);
+      res_write(data);
     });
     child.on("exit", async function (code, signal) {
       if (code === 0) {
         if (deepClean) {
-          res.write(req.__("Installing sd-notify") + "\n");
+          res_write(req.__("Installing sd-notify") + "\n");
           const sdNotifyCode = await tryInstallSdNotify(req, res);
-          res.write(
+          res_write(
             req.__("sd-notify install done with code %s", sdNotifyCode) + "\n"
           );
         }
         if (runPull) {
-          res.write(
+          res_write(
             req.__("Pulling the capacitor-builder docker image...") + "\n"
           );
           const pullCode = await pullCapacitorBuilder(req, res, version);
-          res.write(req.__("Pull done with code %s", pullCode) + "\n");
+          res_write(req.__("Pull done with code %s", pullCode) + "\n");
           if (pullCode === 0) {
-            res.write(req.__("Pruning docker...") + "\n");
+            res_write(req.__("Pruning docker...") + "\n");
             const pruneCode = await pruneDocker(req, res);
-            res.write(req.__("Prune done with code %s", pruneCode) + "\n");
+            res_write(req.__("Prune done with code %s", pruneCode) + "\n");
           }
         }
       }
+      setTimeout(() => {
+        getState().processSend("RestartServer");
+        process.exit(0);
+      }, 200);
       res.end(
         version === "latest"
           ? req.__(
@@ -1624,10 +1638,6 @@ const doInstall = async (req, res, version, deepClean, runPull) => {
               `Install done with code ${code}.\n\nPress the BACK button in your browser, then RELOAD the page.`
             )
       );
-      setTimeout(() => {
-        getState().processSend("RestartServer");
-        process.exit(0);
-      }, 100);
     });
   }
 };
@@ -1974,9 +1984,8 @@ router.get(
     const filename = `${moment(start).format("YYYYMMDDHHmm")}.html`;
     await File.new_folder("configuration_checks");
     const go = async () => {
-      const { passes, errors, pass, warnings } = await runConfigurationCheck(
-        req
-      );
+      const { passes, errors, pass, warnings } =
+        await runConfigurationCheck(req);
       const end = new Date();
       const secs = Math.round((end.getTime() - start.getTime()) / 1000);
 
@@ -3250,8 +3259,8 @@ router.get(
       mode === "prepare"
         ? "_prepare_step"
         : mode === "finish"
-        ? "_finish_step"
-        : "";
+          ? "_finish_step"
+          : "";
     res.json({
       finished: await checkFiles(out_dir_name, [
         `logs${stepDesc}.txt`,
@@ -3326,8 +3335,8 @@ router.get(
       mode === "prepare"
         ? "_prepare_step"
         : mode === "finish"
-        ? "_finish_step"
-        : "";
+          ? "_finish_step"
+          : "";
     const resultMsg = files.find(
       (file) => file.filename === `logs${stepDesc}.txt`
     )

package/routes/tables.js

@@ -717,8 +717,12 @@ const attribBadges = (f) => {
   let s = "";
   if (f.attributes) {
     Object.entries(f.attributes).forEach(([k, v]) => {
+      if (k === "summary_field") s += badge("secondary", "Summary", v);
+      if (k === "include_fts" && v)
+        s += badge("secondary", "FTS", "Include in full-text search");
       if (
         [
+          "include_fts",
           "summary_field",
           "importance",
           "on_delete_cascade",
@@ -1467,7 +1471,10 @@ router.get(
       res.redirect(`/table/${table.id}`);
       return;
     }
-    const rows = await table.getRows({}, { orderBy: "id", forUser: req.user });
+    const rows = await table.getRows(
+      {},
+      { orderBy: table.pk_name, forUser: req.user }
+    );
     res.setHeader("Content-Type", "text/csv");
     res.setHeader("Content-Disposition", `attachment; filename="${name}.csv"`);
     res.setHeader("Cache-Control", "no-cache");
@@ -2019,6 +2026,7 @@ router.post(
       if (parse_res.error) req.flash("error", parse_res.error);
       else req.flash("success", parse_res.success);
     } catch (e) {
+      console.error("CSV upload error", e);
       req.flash("error", e.message);
     }
     await fs.unlink(f.location);