@saltcorn/server 1.3.0 → 1.3.1-beta.1

package/app.js

@@ -75,7 +75,12 @@ const disabledCsurf = (req, res, next) => {
 
 const noCsrfLookup = (state, pluginRoutesHandler) => {
   const disable_csrf_routes = state.getConfig("disable_csrf_routes", "");
-  const result = new Set(disable_csrf_routes.split(",").map((s) => s.trim()));
+  const result = new Set(
+    disable_csrf_routes
+      .split(",")
+      .map((s) => s.trim())
+      .filter(Boolean)
+  );
 
   for (const url of pluginRoutesHandler.noCsrfUrls) {
     result.add(url);
@@ -429,7 +434,9 @@ const getApp = async (opts = {}) => {
     noCsrf = noCsrfLookup(getState(), pluginRoutesHandler);
     app.use(function (req, res, next) {
       if (
-        noCsrf?.has(req.url) ||
+        [...(noCsrf || [])].some((url_prefix) =>
+          req.url.startsWith(url_prefix)
+        ) ||
         (req.smr &&
           (req.url.startsWith("/api/") ||
             req.url === "/auth/login-with/jwt" ||

package/auth/roleadmin.js

@@ -104,13 +104,35 @@ const editRole2FAPolicyForm = (role, twofa_policy_by_role, req) =>
     )
   );
 
+const editRolePushPolicyForm = (role, push_policy_by_role, req) =>
+  form(
+    {
+      action: `/roleadmin/setrolepushpolicy/${role.id}`,
+      method: "post",
+    },
+    csrfField(req),
+    select(
+      {
+        name: "policy",
+        onchange: "form.submit()",
+        class: "form-select form-select-sm w-unset d-inline",
+      },
+      ["Always", "Default on", "Default off", "Never"].map((p) =>
+        option(
+          { selected: (push_policy_by_role[role.id] || "Default on") === p },
+          p
+        )
+      )
+    )
+  );
+
 /**
  * @param {object} req
  * @returns {Form}
  */
 const roleForm = (req) =>
   new Form({
-    action: "/roleadmin/edit",    
+    action: "/roleadmin/edit",
     fields: [
       {
         name: "id",
@@ -145,6 +167,8 @@ router.get(
     );
     const layout_by_role = getState().getConfig("layout_by_role");
     const twofa_policy_by_role = getState().getConfig("twofa_policy_by_role");
+    const push_policy_by_role = getState()?.getConfig("push_policy_by_role") || {};
+    const pushEnabled = getState().getConfig("enable_push_notify");
     const auth_methods = Object.keys(getState().auth_methods);
 
     auth_methods.unshift("Password");
@@ -182,6 +206,21 @@ router.get(
                     ? ""
                     : editRole2FAPolicyForm(role, twofa_policy_by_role, req),
               },
+              ...(pushEnabled
+                ? [
+                    {
+                      label: req.__("Push notifications"),
+                      key: (role) =>
+                        role.id === 100
+                          ? ""
+                          : editRolePushPolicyForm(
+                              role,
+                              push_policy_by_role,
+                              req
+                            ),
+                    },
+                  ]
+                : []),
               ...(auth_methods.length > 1
                 ? [
                     {
@@ -325,6 +364,20 @@ router.post(
   })
 );
 
+router.post(
+  "/setrolepushpolicy/:id",
+  isAdmin,
+  error_catcher(async (req, res) => {
+    const { id } = req.params;
+    const push_policy_by_role = getState()?.getConfigCopy("push_policy_by_role") || {};
+    push_policy_by_role[+id] = (req.body || {}).policy;
+    await getState().setConfig("push_policy_by_role", push_policy_by_role);
+    req.flash("success", req.__(`Saved push policy for role`));
+
+    res.redirect(`/roleadmin`);
+  })
+);
+
 router.post(
   "/setrole_allowed_auth_methods/:id",
   isAdmin,

package/auth/routes.js

@@ -266,10 +266,15 @@ const loginWithJwt = async (email, password, saltcornApp, res, req) => {
       const user = await User.findOne({ email });
       if (user && user.checkPassword(password)) {
         const now = new Date();
+        const pushEnabled = !!user._attributes?.notify_push;
+        const tokenUser = { ...user.session_object };
+        if (tokenUser.attributes)
+          tokenUser.attributes.notify_push = pushEnabled;
+        else tokenUser._attributes = { notify_push: pushEnabled };
         const token = jwt.sign(
           {
             sub: email,
-            user: user.session_object,
+            user: tokenUser,
             iss: "saltcorn@saltcorn",
             aud: "saltcorn-mobile-app",
             iat: now.valueOf(),