@saltcorn/server 1.1.3-rc.0 → 1.1.4-alpha.0

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Notable changes
 
-## 1.1.3 - In beta
+## 1.1.3 - Released 25 March 2025
 
 * A POST route for the reload management api (`/scapi/reload`) which takes as body JSON
   a newly created tenant with `saltcorn create-tenant` CLI (`new_tenant` JSON key) or an

package/app.js

@@ -66,9 +66,11 @@ const disabledCsurf = (req, res, next) => {
 };
 
 const noCsrfLookup = (state) => {
-  if (!state.plugin_routes) return null;
+  const disable_csrf_routes = state.getConfig("disable_csrf_routes", "");
+  const result = new Set(disable_csrf_routes.split(",").map((s) => s.trim()));
+
+  if (!state.plugin_routes) return result;
   else {
-    const result = new Set();
     for (const routes of Object.values(state.plugin_routes)) {
       for (const url of routes
         .filter((r) => r.noCsrf === true)
@@ -206,7 +208,7 @@ const getApp = async (opts = {}) => {
           if (fs.existsSync(path.join(loc, "locales", `${locale}.json`))) {
             const xlations = JSON.parse(
               fs.readFileSync(path.join(loc, "locales", `${locale}.json`))
-            );          
+            );
             Object.assign(staticCatalog[locale], xlations);
           }
 

package/auth/admin.js

@@ -398,6 +398,7 @@ const http_settings_form = async (req) =>
       "body_limit",
       "url_encoded_limit",
       ...(!db.isSQLite ? ["prune_session_interval"] : []),
+      "disable_csrf_routes",
     ],
     action: "/useradmin/http",
     submitLabel: req.__("Save"),

package/auth/testhelp.js

@@ -178,6 +178,58 @@ const getAdminLoginCookie = async () => {
   return resToLoginCookie(res);
 };
 
+const getAdminJwt = async () => {
+  const app = await getApp({ disableCsrf: true });
+  const headers = {
+    "X-Requested-With": "XMLHttpRequest",
+    "X-Saltcorn-Client": "mobile-app",
+  };
+  const res = await request(app)
+    .get(
+      `/auth/login-with/jwt?email=${encodeURIComponent(
+        "admin@foo.com"
+      )}&password=${encodeURIComponent("AhGGr6rhu45")}`
+    )
+
+    .set(headers);
+  if (res.statusCode !== 200) console.log(res.text);
+  return res.body;
+};
+
+const getStaffJwt = async () => {
+  const app = await getApp({ disableCsrf: true });
+  const headers = {
+    "X-Requested-With": "XMLHttpRequest",
+    "X-Saltcorn-Client": "mobile-app",
+  };
+  const res = await request(app)
+    .get(
+      `/auth/login-with/jwt?email${encodeURIComponent(
+        "staff@foo.com"
+      )}&password=${encodeURIComponent("ghrarhr54hg")}`
+    )
+    .set(headers);
+  if (res.statusCode !== 200) console.log(res.text);
+  return res.body;
+};
+
+const getUserJwt = async () => {
+  const app = await getApp({ disableCsrf: true });
+  const headers = {
+    "X-Requested-With": "XMLHttpRequest",
+    "X-Saltcorn-Client": "mobile-app",
+  };
+  const res = await request(app)
+    .get(
+      `/auth/login-with/jwt?email=${encodeURIComponent(
+        "user@foo.com"
+      )}&password=${encodeURIComponent("GFeggwrwq45fjn")}`
+    )
+    .set(headers);
+  if (res.statusCode !== 200) console.log(res.text);
+  return res.body;
+};
+
 /**
  *
  * @param {*} width
@@ -402,6 +454,9 @@ module.exports = {
   getStaffLoginCookie,
   getAdminLoginCookie,
   getUserLoginCookie,
+  getAdminJwt,
+  getStaffJwt,
+  getUserJwt,
   prepScreenInfoCookie,
   prepUserAgent,
   itShouldRedirectUnauthToLogin,