@saltcorn/server 1.1.4-beta.9 → 1.2.0-beta.0

package/CHANGELOG.md

@@ -1,6 +1,19 @@
 # Notable changes
 
-## 1.1.4 - In beta
+## 1.2.0 - In Beta
+
+## 1.1.4 - Released 28 April 2025
+
+* Admin can disable 2FA for any user. 
+
+* Introduce an API for discovering SQL columns in types provided by modules, 
+  which have type modifiers (e.g. vector length in pgvector)
+
+* List: Enabling Row click action or link no longer breaks Links, actions
+  and dropdown menus in columns
+
+* Email server can be authorized with OAuth. Use GraphAPI for Microsoft 
+  email servers.
 
 * Role IDs 2-10 are now available for use. As a consequence, backups from before Saltcorn 0.8.7 can no
   longer be restored. To restore a backup from 0.8.6, restore on Saltcorn any version 0.8.7 - 1.0 
@@ -18,6 +31,7 @@
     - The site name and addiotnal login strings are translated
     - Translate app strings with LLM if module is present
     - Translate Action and viewlink labels, list headers and page and popup titles.
+    - Options from String field attributes can now be translated.
 
 
 * Transactional isolation: Most administrative actions and user-run data 
@@ -34,6 +48,8 @@
 * 3054: Use !==, >, >= etc in dynamnic where in Edit
 * 2893: Fix link to manage tags in table admin
 * 2821: use tables element in emails
+* 3186: Admin user edit no longer clears file fields on user
+* 3184: Fix delete columns in list views embedded in Edit views
 
 ## 1.1.3 - Released 25 March 2025
 

package/auth/admin.js

@@ -124,7 +124,9 @@ const userForm = async (req, user) => {
   const roles = (await User.get_roles()).filter((r) => r.role !== "public");
   roleField.options = roles.map((r) => ({ label: r.role, value: r.id }));
   const can_reset = getState().getConfig("smtp_host", "") !== "";
-  const userFields = await getUserFields(req);
+  const userFields = (await getUserFields(req)).filter(
+    (f) => f.type !== "File"
+  );
   const form = new Form({
     fields: userFields,
     action: "/useradmin/save",
@@ -990,6 +992,27 @@ router.get(
                 ),
             ],
           },
+          {
+            type: "card",
+            title: req.__("Two-factor authentication"),
+            contents: [
+              div(
+                user._attributes.totp_enabled
+                  ? req.__("Two-factor authentication is enabled")
+                  : req.__("Two-factor authentication is disabled")
+              ),
+              div(
+                user._attributes.totp_enabled
+                  ? post_btn(
+                      `/auth/twofa/disable-totp-admin/${user.id}`,
+                      req.__("Disable 2FA"),
+                      req.csrfToken(),
+                      { btnClass: "btn-danger", req }
+                    )
+                  : ""
+              ),
+            ],
+          },
         ],
       },
     });

package/auth/routes.js

@@ -2011,6 +2011,30 @@ router.post(
     res.redirect("/auth/settings");
   })
 );
+router.post(
+  "/twofa/disable-totp-admin/:uid",
+  isAdmin,
+  error_catcher(async (req, res) => {
+    const { uid } = req.params;
+    const user = await User.findOne({ id: uid });
+    if (!user) {
+      req.flash("danger", req.__("User not found"));
+      res.redirect("/useradmin");
+      return;
+    }
+
+    user._attributes.totp_enabled = false;
+    delete user._attributes.totp_key;
+    await user.update({ _attributes: user._attributes });
+    req.flash(
+      "success",
+      req.__(
+        "Two-factor authentication with Time-based One-Time Password disabled"
+      )
+    );
+    res.redirect(`/useradmin/${uid}`);
+  })
+);
 /**
  * totpForm (TWA)
  * @param {*} req