@saltcorn/server 1.3.0-beta.0 → 1.3.0-beta.10

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Notable changes
 
+## 1.3.0 - In beta
+
+* Aggregation formulae: In view formulae, you can now use aggregation formulae. The syntax for this is `{inbound_table}${inboundkey_field}${target_field}${aggrgation}` The aggregation (which should be lower case) can be ommitted and defaults to `array_agg`. Examples: `patients$favbook$id$count` or `patients$favbook$id`. This is useful if you want a count in a view link label without creating a stored calculated field.
+
+* Builder:
+    - List columns can have containers in columns, and multiple elements in each column
+
+* Template generation: generate basic views from template tables. 
+
+* Login and signup from any edit view on users. Login respond to trigger results (goto URL, toast notifications).
+
+* Real-time collaboration foundations. Views patterns must be adapted to take advantage of this. 
+
+* View embeddings in Edit are now live and respond to changes in Key field values if embedded views are based on this relations.
+
+* S3 automated backup destination
+
+* refresh_user_session action: run then the sessions user variable needs to be
+  updated because the users table row has changed.
+
+### Fixes
+
+* Restore partial matches with full text search
+* Several mobile builder fixes
+
 ## 1.2.0 - Released 21 May 2025
 
 * Create Table by CSV upload now accepts String and UUID primary keys and 

package/app.js

@@ -7,7 +7,11 @@
 const express = require("express");
 const mountRoutes = require("./routes");
 
-const { getState, init_multi_tenant } = require("@saltcorn/data/db/state");
+const {
+  getState,
+  getRootState,
+  init_multi_tenant,
+} = require("@saltcorn/data/db/state");
 const db = require("@saltcorn/data/db");
 const passport = require("passport");
 const CustomStrategy = require("passport-custom").Strategy;
@@ -28,7 +32,10 @@ const {
   getSessionStore,
   setTenant,
 } = require("./routes/utils.js");
-const { getAllTenants } = require("@saltcorn/admin-models/models/tenant");
+const {
+  getAllTenants,
+  eachTenant,
+} = require("@saltcorn/admin-models/models/tenant");
 const path = require("path");
 const helmet = require("helmet");
 const wrapper = require("./wrapper");
@@ -45,6 +52,7 @@ const cors = require("cors");
 const api = require("./routes/api");
 const scapi = require("./routes/scapi");
 const fs = require("fs");
+const PluginRoutesHandler = require("./plugin_routes_handler");
 
 const locales = Object.keys(available_languages);
 // jwt config
@@ -65,39 +73,14 @@ const disabledCsurf = (req, res, next) => {
   next();
 };
 
-const noCsrfLookup = (state) => {
+const noCsrfLookup = (state, pluginRoutesHandler) => {
   const disable_csrf_routes = state.getConfig("disable_csrf_routes", "");
   const result = new Set(disable_csrf_routes.split(",").map((s) => s.trim()));
 
-  if (!state.plugin_routes) return result;
-  else {
-    for (const routes of Object.values(state.plugin_routes)) {
-      for (const url of routes
-        .filter((r) => r.noCsrf === true)
-        .map((r) => r.url)) {
-        result.add(url);
-      }
-    }
-    return result;
+  for (const url of pluginRoutesHandler.noCsrfUrls) {
+    result.add(url);
   }
-};
-
-const prepPluginRouter = (pluginRoutes) => {
-  const router = express.Router();
-  for (const routes of Object.values(pluginRoutes)) {
-    for (const route of routes) {
-      switch (route.method) {
-        case "post":
-          router.post(route.url, error_catcher(route.callback));
-          break;
-        case "get":
-        default:
-          router.get(route.url, error_catcher(route.callback));
-          break;
-      }
-    }
-  }
-  return router;
+  return result;
 };
 
 // todo console.log app instance info when app stxarts - avoid to show secrets (password, etc)
@@ -237,9 +220,13 @@ const getApp = async (opts = {}) => {
 
   app.use(passport.initialize());
   app.use(passport.authenticate(["jwt", "session"]));
+  const isPlaywright = process.env.SALTCORN_SERVE_MOBILE_TEST_BUILD?.length > 0;
   app.use((req, res, next) => {
     // no jwt and session id at the same time
-    if (!(jwt_extractor(req) && req.cookies && req.cookies["connect.sid"]))
+    if (
+      !(jwt_extractor(req) && req.cookies && req.cookies["connect.sid"]) ||
+      isPlaywright
+    )
       next();
   });
   app.use(flash());
@@ -249,14 +236,14 @@ const getApp = async (opts = {}) => {
   //legacy
   app.use(
     express.static(__dirname + "/public", {
-      maxAge: development_mode ? 0 : 1000 * 60 * 15,
+      maxAge: 1000 * 60 * 60 * 24,
     })
   );
   app.use(
     express.static(
       path.dirname(require.resolve("@saltcorn/builder/package.json")) + "/dist",
       {
-        maxAge: development_mode ? 0 : 1000 * 60 * 30,
+        maxAge: 1000 * 60 * 60 * 24,
       }
     )
   );
@@ -264,15 +251,24 @@ const getApp = async (opts = {}) => {
   if (process.env.SALTCORN_SERVE_ADDITIONAL_DIR)
     app.use(
       express.static(process.env.SALTCORN_SERVE_ADDITIONAL_DIR, {
-        maxAge: development_mode ? 0 : 1000 * 60 * 15,
+        maxAge: 1000 * 60 * 60 * 24,
       })
     );
   let version_tag = db.connectObj.version_tag;
 
+  if (process.env.SALTCORN_SERVE_MOBILE_TEST_BUILD) {
+    app.use(
+      "/mobile_test_build",
+      express.static(process.env.SALTCORN_SERVE_MOBILE_TEST_BUILD, {
+        maxAge: "100d",
+      })
+    );
+  }
+
   app.use(
     `/static_assets/${version_tag}`,
     express.static(__dirname + "/public", {
-      maxAge: development_mode ? 0 : "100d",
+      maxAge: "100d",
     })
   );
   app.use(
@@ -280,7 +276,7 @@ const getApp = async (opts = {}) => {
     express.static(
       path.dirname(require.resolve("@saltcorn/builder/package.json")) + "/dist",
       {
-        maxAge: development_mode ? 0 : "100d",
+        maxAge: "100d",
       }
     )
   );
@@ -290,7 +286,7 @@ const getApp = async (opts = {}) => {
       path.dirname(require.resolve("@saltcorn/filemanager/package.json")) +
         "/public/build",
       {
-        maxAge: development_mode ? 0 : "100d",
+        maxAge: "100d",
       }
     )
   );
@@ -412,10 +408,25 @@ const getApp = async (opts = {}) => {
   app.use("/api", api);
   app.use("/scapi", scapi);
 
+  const pluginRoutesHandler = new PluginRoutesHandler();
+  await eachTenant(async () => {
+    pluginRoutesHandler.initTenantRouter(
+      db.getTenantSchema(),
+      getState().plugin_routes || {}
+    );
+    getState().routesChangedCb = () => {
+      pluginRoutesHandler.initTenantRouter(
+        db.getTenantSchema(),
+        getState().plugin_routes || {}
+      );
+      noCsrf = noCsrfLookup(getRootState(), pluginRoutesHandler);
+    };
+  });
+
   const csurf = csrf();
   let noCsrf = null;
   if (!opts.disableCsrf) {
-    noCsrf = noCsrfLookup(getState());
+    noCsrf = noCsrfLookup(getState(), pluginRoutesHandler);
     app.use(function (req, res, next) {
       if (
         noCsrf?.has(req.url) ||
@@ -434,17 +445,29 @@ const getApp = async (opts = {}) => {
   } else app.use(disabledCsurf);
 
   mountRoutes(app);
-  // mount plugin router with a callback for changes
-  let pluginRouter = prepPluginRouter(getState().plugin_routes || {});
-  getState().routesChangedCb = () => {
-    pluginRouter = prepPluginRouter(getState().plugin_routes || {});
-    noCsrf = noCsrfLookup(getState());
-  };
-  app.use((req, res, next) => {
-    pluginRouter(req, res, next);
-  });
   // set tenant homepage as / root
   app.get("/", error_catcher(homepage));
+
+  app.use((req, res, next) => {
+    const tenant = db.getTenantSchema();
+    if (!pluginRoutesHandler.tenantRouters[tenant]) {
+      // if tenant router is not initialized, try to initialize it
+      pluginRoutesHandler.initTenantRouter(
+        tenant,
+        getState().plugin_routes || {}
+      );
+      getState().routesChangedCb = () => {
+        pluginRoutesHandler.initTenantRouter(
+          tenant,
+          getState().plugin_routes || {}
+        );
+        noCsrf = noCsrfLookup(getRootState(), pluginRoutesHandler);
+      };
+    }
+    if (pluginRoutesHandler.tenantRouters[tenant])
+      pluginRoutesHandler.tenantRouters[tenant](req, res, next);
+    else next();
+  });
   // /robots.txt
   app.get(
     "/robots.txt",

package/auth/routes.js

@@ -195,6 +195,30 @@ const resetForm = (body, req) => {
   return form;
 };
 
+/**
+ * Restore System Backup Password Form
+ * @param {object} req
+ * @param {string} fileId
+ * @returns {Form}
+ */
+const restoreBackupPasswordForm = (req) =>
+  new Form({
+    blurb: req.__(
+      "To restore a system backup, please enter the password you set when you created the backup."
+    ),
+    fields: [
+      new Field({
+        label: req.__("Password"),
+        name: "password",
+        type: "String",
+        attributes: { input_type: "password" },
+        validator: (s) => s.length > 0,
+      }),
+    ],
+    action: "/auth/restore_backup_password",
+    submitLabel: req.__("Restore system backup"),
+  });
+
 /**
  * get Auth Links
  * @param {string} current
@@ -635,22 +659,42 @@ router.post(
   setTenant, // TODO why is this needed?????
   error_catcher(async (req, res) => {
     const hasUsers = await User.nonEmpty();
-    if (!hasUsers) {
-      const newPath = File.get_new_path();
-      await req.files.file.mv(newPath);
+    if (hasUsers) {
+      req.flash("danger", req.__("Users already present"));
+      return res.redirect("/auth/login");
+    }
+
+    if (!req.files?.file) {
+      req.flash("danger", req.__("No backup file uploaded"));
+      return res.redirect("/auth/create_first_user");
+    }
+
+    const newPath = File.get_new_path();
+    await req.files.file.mv(newPath);
+
+    try {
       const err = await restore(
         newPath,
         (p) => load_plugins.loadAndSaveNewPlugin(p),
         true
       );
+
       if (err) req.flash("error", err);
       else req.flash("success", req.__("Successfully restored backup"));
-      fs.unlink(newPath, function () {});
+
+      fs.unlink(newPath, () => {});
       await getState().refresh_plugins();
-      res.redirect(`/auth/login`);
-    } else {
-      req.flash("danger", req.__("Users already present"));
-      res.redirect("/auth/login");
+      return res.redirect("/auth/login");
+    } catch (error) {
+      if (error.requiresPassword) {
+        // Storing the file path in session
+        req.session.restoreBackupPath = newPath;
+        return res.redirect("/auth/restore_backup_password");
+      }
+
+      fs.unlink(newPath, () => {});
+      req.flash("danger", error.message);
+      return res.redirect("/auth/create_first_user");
     }
   })
 );
@@ -702,6 +746,70 @@ router.post(
   })
 );
 
+/**
+ * @name get/restore_backup_password
+ * @function
+ * @memberof module:auth/routes~routesRouter
+ */
+router.get(
+  "/restore_backup_password",
+  error_catcher(async (req, res) => {
+    if (!req.session.restoreBackupPath) {
+      req.flash("danger", req.__("Backup session expired"));
+      return res.redirect("/auth/create_first_user");
+    }
+
+    res.sendAuthWrap(
+      req.__("Restore system backup"),
+      restoreBackupPasswordForm(req),
+      {}
+    );
+  })
+);
+
+/**
+ * @name post/restore_backup_password
+ * @function
+ * @memberof module:auth/routes~routesRouter
+ */
+router.post(
+  "/restore_backup_password",
+  error_catcher(async (req, res) => {
+    const { password } = req.body;
+    const backupPath = req.session.restoreBackupPath;
+
+    if (!backupPath) {
+      req.flash("danger", req.__("Backup session expired"));
+      return res.redirect("/auth/create_first_user");
+    }
+
+    try {
+      const err = await restore(
+        backupPath,
+        (p) => load_plugins.loadAndSaveNewPlugin(p),
+        true,
+        password
+      );
+
+      // Cleanup
+      fs.unlink(backupPath, () => {});
+      delete req.session.restoreBackupPath;
+
+      if (err) req.flash("error", err);
+      else req.flash("success", req.__("Successfully restored backup"));
+
+      await getState().refresh_plugins();
+      return res.redirect("/auth/login");
+    } catch (error) {
+      req.flash(
+        "danger",
+        error.message || req.__("Incorrect backup password, try again")
+      );
+      return res.redirect("/auth/restore_backup_password");
+    }
+  })
+);
+
 /**
  * @param {string} new_user_view_name
  * @param {object} req
@@ -1192,10 +1300,27 @@ router.post(
       }
     const session_id = getSessionId(req);
 
-    Trigger.emitEvent("Login", null, req.user, {
-      session_id,
-      old_session_id: req.old_session_id,
-    });
+    const resultCollector = {};
+    await Trigger.runTableTriggers(
+      "Login",
+      null,
+      req.user,
+      resultCollector,
+      req.user
+    );
+    if (resultCollector.notify) {
+      req.flash("warning", resultCollector.notify);
+    }
+    if (resultCollector.error) {
+      req.flash("error", resultCollector.error);
+    }
+    if (resultCollector.notify_success) {
+      req.flash("success", resultCollector.notify_success);
+    }
+    if (resultCollector.goto) {
+      res.redirect(resultCollector.goto);
+      return;
+    }
     res?.cookie?.("loggedin", "true", maxAge ? { maxAge } : undefined);
     req.flash("success", req.__("Welcome, %s!", req.user.email));
     if (req.smr) {