@saltcorn/server 1.6.0-beta.1 → 1.6.0-beta.10

package/CHANGELOG.md

@@ -2,7 +2,49 @@
 
 ## 1.6.0 - In development
 
-* Elements can now be added to the top right (left in RTL languages) of cards, if a title is given.
+* Admin tabulator now automatically stretches to bottom of the screen
+
+* Rescan fields in table settings to resync Saltcorn representation with on-disk format.
+
+* Detailed contents shown in module store where available
+
+* run_js_code action run on the client page now execute directly without a server detour.
+
+* Button to create standard fields (name, description, created at/by, updated at/by) in tables
+
+* Default field values can now be given by an expression. This makes it easier to make created at/by fields
+
+* String fields with options are now translated.
+
+* Entities list shows most recently edited entities
+
+* `old_row` can now be accessed in Update trigger only if.. formula
+
+* If List column show if true formula does not access fields (e.g. based only on `user`) the whole column is now shown or hidden.
+
+* User roles below admin can now be given permission to edit users with the same user interface as that used by admin (at /useradmin URLs).
+
+* If the copilot is installed, it can now help write or change run_js_code scripts ("Edit with AI" button)
+
+* In the `relative` fieldview for date fields, the full time is shown when on hover (using the title attribute)
+
+* Typescript types are now stripped from run_js_code actions and code pages (if on Node.js 22.13.0 or later)
+
+* If logged in as admin, a popover now appears on hovering over any embedded view with a link to configure
+
+* Click-to-edit on dates will use flatpickr if it is installed as a module
+
+* Stored calculated fields are now calculated on field creation
+
+* Many identifiers or entity names now appear with an icon to copy to clipboard on hover. This is also avaliable as an option on the as_text fieldview for String fields.
+
+* `assert` is now available in run_js_code actions. This is the strict version from Node's assert module.
+
+* Module reload and cache purge on SIGHUP
+
+* Default Edit forms are now more responsive: two column on desktop, one-column on mobile, with responsive label alignment
+
+* The Startup event is now run on backup restore.
 
 * List views now have a "Tree Field" option, for self-join keys, to show the rows as a tree as an indented indicator in the first column. If a tree field is chosen, sorting by joinfields and aggregations is disabled. 
 
@@ -10,13 +52,28 @@
 
 * Keyboard shortcuts can be defined for menu items
 
-* The builder is now based on craft.js 0.2.12 and the drag-and-drop is much improved
+* Builder updates:
+    * Based on craft.js 0.2.12
+    * Drag-and-drop is much improved, both in the canvas and in the layers
+    * Layers visual update, buttons for movement
+    * If the copilot is installed, elements can be generated or altered with LLMs
+    * The builder now works on touch devices, for example tablets
+    * Code expand popout for code inputs
+    * Device selector with mobile and tablet preview. Some settings can be set per-device.
+    * Individual columns are can now be moved and deleted.
+    * Elements can now be added to the top right (left in RTL languages) of cards, if a title is given.
+
 
 * The `res` is now available in actions, allowing you to, for instance, set cookies
 
 * Set additional workflow context in the builder when a workflow action is selected
 
-* Entities list: search modules and users, multiselect with delete, deep search option, keyboard shortcuts
+* Entities list: 
+    * search modules and users
+    * multiselect with delete
+    * pack download and role change
+    * deep search option
+    * keyboard shortcuts
 
 * Instances run in multi-node mode will now automatically select a leader to run the schedule
 
@@ -37,6 +94,18 @@
 
 * Reduce the number of network requests in Edit forms with complex logic
 
+### Security
+
+* Protection against SQL injection in the jsexprToSQL function. To our knowledge this can only be accessed by users with administrative privileges.
+
+* Tenants can only be created on subtenants if the role to create tenants is public. This avoids a confusing situation where the role check was not against root roles but against the subtenant roles when the tenant was created from a subtenants.
+
+* Prevent tenants from installing git/github plugins from backups and packs
+
+* Ownership checks in table sync with mobile apps
+
+* Cookie "secure" property set if using https or if the "force secure" option is chosen
+
 ## 1.5.0 - Released 26 January 2026
 
 * thumbs_up_down fieldview for booleans fields, as an alternative to tristate

package/app.js

@@ -19,7 +19,7 @@ const BearerStrategy = require("passport-http-bearer");
 const User = require("@saltcorn/data/models/user");
 const File = require("@saltcorn/data/models/file");
 const flash = require("connect-flash");
-const { loadAllPlugins } = require("./load_plugins");
+const Plugin = require("@saltcorn/data/models/plugin");
 const homepage = require("./routes/homepage");
 const errors = require("./errors");
 const {
@@ -67,6 +67,7 @@ const jwtOpts = {
   secretOrKey: jwt_secret,
   issuer: "saltcorn@saltcorn",
   audience: "saltcorn-mobile-app",
+  passReqToCallback: true,
 };
 
 const disabledCsurf = (req, res, next) => {
@@ -102,7 +103,7 @@ const getApp = async (opts = {}) => {
   // switch on sql logging
   if (sql_log) db.set_sql_logging(); // dont override cli flag
   // load all plugins
-  await loadAllPlugins();
+  await Plugin.loadAllPlugins();
   // get development mode status
   const development_mode = getState().getConfig("development_mode", false);
   // switch on sql logging - but it was initiated before???
@@ -118,6 +119,8 @@ const getApp = async (opts = {}) => {
     false
   );
   app.set("query parser", "extended");
+  if (getState().getConfig("force_secure_cookies", false))
+    app.set("trust proxy", 1);
 
   const helmetOptions = {
     contentSecurityPolicy: {
@@ -214,7 +217,11 @@ const getApp = async (opts = {}) => {
   // init multitenant mode
   if (db.is_it_multi_tenant()) {
     const tenants = await getAllTenants();
-    await init_multi_tenant(loadAllPlugins, opts.disableMigrate, tenants);
+    await init_multi_tenant(
+      Plugin.loadAllPlugins,
+      opts.disableMigrate,
+      tenants
+    );
   }
   const pruneSessionInterval = +getState().getConfig(
     "prune_session_interval",
@@ -230,10 +237,14 @@ const getApp = async (opts = {}) => {
   app.use((req, res, next) => {
     // no jwt and session id at the same time
     if (
-      !(jwt_extractor(req) && req.cookies && req.cookies["connect.sid"]) ||
+      !(req.jwtAuthenticated && req.cookies && req.cookies["connect.sid"]) ||
       isPlaywright
     )
       next();
+    else
+      res.status(400).json({
+        error: "Cannot authenticate with both JWT and session cookie",
+      });
   });
   app.use(flash());
 
@@ -338,7 +349,7 @@ const getApp = async (opts = {}) => {
         const mu =
           (await User.findByApiToken(token)) ||
           (await User.findOne({ api_token: token }));
-        if (mu && token && token.length > 5)
+        if (mu && !mu.disabled && token && token.length > 5)
           return done(
             null,
             {
@@ -357,19 +368,26 @@ const getApp = async (opts = {}) => {
     })
   );
   passport.use(
-    new JwtStrategy(jwtOpts, async (jwt_payload, done) => {
+    new JwtStrategy(jwtOpts, async (req, jwt_payload, done) => {
       const userCheck = async () => {
+        if (jwt_payload.sub === "public") {
+          req.jwtAuthenticated = true;
+          return done(null, { role_id: 100 });
+        }
         const u = await User.findOne({ email: jwt_payload.sub });
         if (
           u &&
+          !u.disabled &&
+          !u._attributes?.totp_enabled &&
           u.last_mobile_login &&
           (typeof u.last_mobile_login === "string"
             ? new Date(u.last_mobile_login).valueOf()
             : u.last_mobile_login) <= jwt_payload.iat
         ) {
+          req.jwtAuthenticated = true;
           return done(null, u.session_object);
         } else {
-          return done(null, { role_id: 100 });
+          return done(null, false);
         }
       };
       if (
@@ -415,9 +433,6 @@ const getApp = async (opts = {}) => {
 
   app.use(wrapper(version_tag));
 
-  app.use("/api", api);
-  app.use("/scapi", scapi);
-
   const pluginRoutesHandler = new PluginRoutesHandler();
   await eachTenant(async () => {
     pluginRoutesHandler.initTenantRouter(
@@ -446,16 +461,21 @@ const getApp = async (opts = {}) => {
           (req.url.startsWith("/api/") ||
             req.url === "/auth/login-with/jwt" ||
             req.url === "/auth/signup")) ||
-        jwt_extractor(req) ||
+        req.jwtAuthenticated ||
+        req.headers.authorization?.toLowerCase().startsWith("bearer ") ||
         req.url === "/auth/callback/saml" ||
         req.url.startsWith("/notifications/share-handler") ||
-        req.url.startsWith("/notifications/manifest")
+        req.url.startsWith("/notifications/manifest") ||
+        (req.url.startsWith("/api/") && !req.cookies?.["connect.sid"])
       )
         return disabledCsurf(req, res, next);
       csurf(req, res, next);
     });
   } else app.use(disabledCsurf);
 
+  app.use("/api", api);
+  app.use("/scapi", scapi);
+
   mountRoutes(app);
   // set tenant homepage as / root
   app.get("/", error_catcher(homepage));

package/auth/admin.js

@@ -26,6 +26,7 @@ const {
   error_catcher,
   addOnDoneRedirect,
   is_relative_url,
+  isAdminOrHasConfigMinRole,
 } = require("../routes/utils");
 const { send_reset_email } = require("./resetpw");
 const { getState } = require("@saltcorn/data/db/state");
@@ -136,7 +137,9 @@ const userForm = async (req, user) => {
     type: "Key",
     reftable_name: "roles",
   });
-  const roles = (await User.get_roles()).filter((r) => r.role !== "public");
+  const roles = (await User.get_roles()).filter(
+    (r) => r.role !== "public" && r.id >= req.user.role_id
+  );
   roleField.options = roles.map((r) => ({ label: r.role, value: r.id }));
   const can_reset = getState().getConfig("smtp_host", "") !== "";
   const userFields = (await getUserFields(req)).filter(
@@ -201,11 +204,15 @@ const user_dropdown = (user, req, can_reset) =>
       },
       '<i class="fas fa-edit"></i>&nbsp;' + req.__("Edit")
     ),
-    post_dropdown_item(
-      `/useradmin/become-user/${user.id}`,
-      '<i class="fas fa-ghost"></i>&nbsp;' + req.__("Become user"),
-      req
-    ),
+    ...(req.user.role_id === 1
+      ? [
+          post_dropdown_item(
+            `/useradmin/become-user/${user.id}`,
+            '<i class="fas fa-ghost"></i>&nbsp;' + req.__("Become user"),
+            req
+          ),
+        ]
+      : []),
     post_dropdown_item(
       `/useradmin/set-random-password/${user.id}`,
       '<i class="fas fa-random"></i>&nbsp;' + req.__("Set random password"),
@@ -264,7 +271,7 @@ const user_dropdown = (user, req, can_reset) =>
  */
 router.get(
   "/",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
   error_catcher(async (req, res) => {
     const auth_methods = getState().auth_methods;
     const userBadges = (user) =>
@@ -282,7 +289,10 @@ router.get(
             span({ class: "badge bg-secondary me-1" }, v.label || k)
           )
       );
-    const users = await User.find({}, { orderBy: "id" });
+    const users = await User.find(
+      { role_id: { gt: req.user.role_id, equal: true } },
+      { orderBy: "id" }
+    );
     const roles = await User.get_roles();
     let roleMap = {};
     roles.forEach((r) => {
@@ -344,7 +354,8 @@ router.get(
  */
 router.get(
   "/new",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const form = await userForm(req);
     send_users_page({
@@ -415,6 +426,7 @@ const http_settings_form = async (req) =>
       "cookie_duration",
       "cookie_duration_remember",
       "cookie_samesite",
+      "force_secure_cookies",
       "content_security_policy",
       "cors_enabled",
       "public_cache_maxage",
@@ -459,6 +471,7 @@ const permissions_settings_form = async (req) =>
       "min_role_edit_files",
       "min_role_edit_search",
       "min_role_create_snapshots",
+      "min_role_edit_users",
       //hidden            "exttables_min_role_read",
     ],
     action: "/useradmin/permissions",
@@ -967,10 +980,16 @@ router.get(
  */
 router.get(
   "/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const user = await User.findOne({ id });
+    if (user.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     const form = await userForm(req, user);
 
     send_users_page({
@@ -1117,7 +1136,8 @@ router.get(
  */
 router.post(
   "/save",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     let form, sub2;
     if ((req.body || {}).id) {
@@ -1153,6 +1173,11 @@ router.post(
       _csrf,
       ...rest
     } = form.values;
+    if (role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     if (id) {
       try {
         const u = await User.findOne({ id });
@@ -1201,10 +1226,16 @@ router.post(
  */
 router.post(
   "/reset-password/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await send_reset_email(u, req, { from_admin: true });
     req.flash("success", req.__(`Reset password link sent to %s`, u.email));
 
@@ -1220,11 +1251,17 @@ router.post(
  */
 router.post(
   "/send-verification/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
     // todo add test case
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     const result = await send_verification_email(u, req);
     if (result.error)
       req.flash(
@@ -1249,10 +1286,16 @@ router.post(
  */
 router.post(
   "/gen-api-token/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.getNewAPIToken();
     req.flash("success", req.__(`New API token generated`));
 
@@ -1268,10 +1311,16 @@ router.post(
  */
 router.post(
   "/remove-api-token/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.removeAPIToken();
     req.flash("success", req.__(`API token removed`));
 
@@ -1287,10 +1336,16 @@ router.post(
  */
 router.post(
   "/revoke-api-token/:uid/:tokenId",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { uid, tokenId } = req.params;
     const u = await User.findOne({ id: uid });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.revokeApiToken(+tokenId);
     req.flash("success", req.__(`API token revoked`));
     res.redirect(getOnDoneRedirect(req, `/useradmin/${u.id}`));
@@ -1302,10 +1357,16 @@ router.post(
  */
 router.post(
   "/revoke-original-api-token/:uid",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { uid } = req.params;
     const u = await User.findOne({ id: uid });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.revokeOriginalApiToken();
     req.flash("success", req.__(`API token revoked`));
     res.redirect(getOnDoneRedirect(req, `/useradmin/${u.id}`));
@@ -1320,10 +1381,16 @@ router.post(
  */
 router.post(
   "/set-random-password/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     const newpw = User.generate_password();
     await u.changePasswordTo(newpw);
     await u.destroy_sessions();
@@ -1372,10 +1439,15 @@ router.post(
  */
 router.post(
   "/disable/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.update({ disabled: true });
     await u.destroy_sessions();
     req.flash("success", req.__(`Disabled user %s`, u.email));
@@ -1390,10 +1462,15 @@ router.post(
  */
 router.post(
   "/force-logout/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.destroy_sessions();
     req.flash("success", req.__(`Logged out user %s`, u.email));
     res.redirect(getOnDoneRedirect(req));
@@ -1407,10 +1484,15 @@ router.post(
  */
 router.post(
   "/enable/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.update({ disabled: false });
     req.flash("success", req.__(`Enabled user %s`, u.email));
     res.redirect(getOnDoneRedirect(req));
@@ -1424,10 +1506,15 @@ router.post(
  */
 router.post(
   "/delete/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.delete();
     req.flash("success", req.__(`User %s deleted`, u.email));