@saltcorn/server 1.6.0-beta.1 → 1.6.0-beta.10

package/routes/eventlog.js

@@ -151,6 +151,30 @@ const logSettingsForm = async (req) => {
         showIf: { [w]: true },
       });
   }
+  fields.push(
+    {
+      input_type: "section_header",
+      label: req.__("Mobile app event permissions"),
+    },
+    {
+      name: "mobile_emit_allowed_events",
+      label: req.__("Authenticated user allowed events"),
+      type: "String",
+      sublabel: req.__(
+        "Comma-separated additional event names that authenticated mobile app users may emit. " +
+          "ReceiveMobileShareData is always allowed."
+      ),
+    },
+    {
+      name: "mobile_emit_public_events",
+      label: req.__("Public user allowed events"),
+      type: "String",
+      sublabel: req.__(
+        "Comma-separated event names that unauthenticated (public) mobile app users may emit. " +
+          "Empty means public users cannot emit any events."
+      ),
+    }
+  );
   return new Form({
     action: "/eventlog/settings",
     noSubmitButton: true,
@@ -188,6 +212,13 @@ router.get(
       let cfgk = `delete_${k}_workflows_days`;
       form.values[cfgk] = getState().getConfig(cfgk);
     });
+    for (const k of [
+      "mobile_emit_allowed_events",
+      "mobile_emit_public_events",
+    ]) {
+      const arr = getState().getConfig(k, []);
+      form.values[k] = Array.isArray(arr) ? arr.join(", ") : arr;
+    }
 
     send_events_page({
       res,
@@ -407,6 +438,22 @@ router.post(
         }
       }
 
+      for (const k of [
+        "mobile_emit_allowed_events",
+        "mobile_emit_public_events",
+      ]) {
+        const raw = form.values[k];
+        await getState().setConfig(
+          k,
+          raw
+            ? raw
+                .split(",")
+                .map((s) => s.trim())
+                .filter(Boolean)
+            : []
+        );
+        delete form.values[k];
+      }
       await getState().setConfig("event_log_settings", form.values);
 
       if (!req.xhr) res.redirect(`/eventlog/settings`);

package/routes/fields.js

@@ -248,7 +248,20 @@ const fieldFlow = (req) =>
     onDone: async (context) => {
       //const thetype = getState().types[context.type];
       const attributes = context.attributes || {};
-      attributes.default = context.default;
+      // attributes.default = context.default;
+
+      const setDefault =
+        context.set_default === undefined || context.set_default === true;
+      if (setDefault && context.default_type === "expression") {
+        attributes.default_expression = context.default_expression;
+        attributes.default = undefined;
+      } else if (setDefault) {
+        attributes.default = context.default;
+        attributes.default_expression = undefined;
+      } else {
+        attributes.default = undefined;
+        attributes.default_expression = undefined;
+      }
       attributes.summary_field = context.summary_field;
       attributes.include_fts = context.include_fts;
       attributes.on_delete_cascade = context.on_delete_cascade;
@@ -333,6 +346,8 @@ const fieldFlow = (req) =>
               }
             );
           }
+          //set updated_at
+          await table.update({});
         });
         await getState().refresh_tables();
 
@@ -571,11 +586,14 @@ const fieldFlow = (req) =>
               {
                 name: "aggwhere",
                 label: req.__("Where"),
-                sublabel: req.__("Formula"),
-                class: "validate-expression",
-                type: "String",
                 required: false,
                 showIf: { expression_type: "Aggregation" },
+                sublabel: req.__(
+                  `Formula evaluating to boolean. Example: <code>status === "Active"</code>`
+                ),
+                class: "validate-expression",
+                type: "String",
+                help: { topic: "Aggregation where formula" },
               },
               ...agg_order_opts,
               {
@@ -751,10 +769,9 @@ const fieldFlow = (req) =>
           const nrows = await table.countRows();
           const formfield = new Field({
             name: "default",
-            label: req.__("Default"),
-            // todo sublabel
+            label: req.__("Default value"),
             type: context.type,
-            required: true,
+            required: false,
             attributes: {
               summary_field: context.summary_field,
               ...(context.attributes || {}),
@@ -762,7 +779,61 @@ const fieldFlow = (req) =>
           });
           await formfield.fill_fkey_options();
           const defaultOptional = nrows === 0 || context.id;
-          if (defaultOptional) formfield.showIf = { set_default: true };
+          const setDefaultShowIf = defaultOptional
+            ? { set_default: true }
+            : undefined;
+
+          if (setDefaultShowIf)
+            formfield.showIf = {
+              ...setDefaultShowIf,
+              default_type: "fixed",
+            };
+          else formfield.showIf = { default_type: "fixed" };
+
+          const defaultTypeOptions = [
+            { label: req.__("Fixed value"), name: "fixed" },
+            { label: req.__("Expression"), name: "expression" },
+          ];
+
+          const expressionShowIf = setDefaultShowIf
+            ? { ...setDefaultShowIf, default_type: "expression" }
+            : { default_type: "expression" };
+
+          const attrEscape = (s) =>
+            s.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
+          const presets = [
+            {
+              label: req.__("Current user ID"),
+              expr: "user && user.id",
+            },
+            {
+              label: req.__("Current user email"),
+              expr: "user && user.email",
+            },
+            {
+              label: req.__("Current timestamp"),
+              expr: "new Date()",
+            },
+            {
+              label: req.__("Current date (ISO)"),
+              expr: "new Date().toISOString().substring(0, 10)",
+            },
+          ];
+          const presetButtons = presets
+            .map(
+              (p) =>
+                `<button type="button" class="btn btn-sm btn-outline-secondary me-1 mb-1" onclick="setDefaultExpressionValue(${attrEscape(JSON.stringify(p.expr))})">${p.label}</button>`
+            )
+            .join("");
+          const setterScript = `<script>
+function setDefaultExpressionValue(val) {
+  var ta = document.querySelector('[name="default_expression"]');
+  if (!ta) return;
+  var monacoDiv = ta.nextElementSibling;
+  var ed = monacoDiv && $(monacoDiv).data && $(monacoDiv).data("monaco-editor");
+  if (ed) { ed.setValue(val); } else { ta.value = val; }
+}
+</script>`;
 
           const form = new Form({
             blurb: defaultOptional
@@ -772,16 +843,51 @@ const fieldFlow = (req) =>
                 ),
             fields: [
               ...(defaultOptional
-                ? [{ name: "set_default", label: "Set Default", type: "Bool" }]
+                ? [
+                    {
+                      name: "set_default",
+                      label: req.__("Set Default"),
+                      type: "Bool",
+                    },
+                  ]
                 : []),
+              {
+                name: "default_type",
+                label: req.__("Default type"),
+                type: "String",
+                attributes: {
+                  options: defaultTypeOptions,
+                },
+                showIf: setDefaultShowIf,
+              },
               formfield,
+              {
+                name: "default_expression",
+                label: req.__("Expression"),
+                sublabel:
+                  req.__(
+                    "JavaScript expression. Available: <code>user</code> (current user). Can be async."
+                  ) + `<div class="mt-1">${presetButtons}</div>${setterScript}`,
+                input_type: "code",
+                attributes: {
+                  mode: "application/javascript",
+                  user: true,
+                },
+                showIf: expressionShowIf,
+              },
             ],
           });
-          if (
+          const hasExprDefault = !!context.default_expression;
+          const hasFixedDefault =
             typeof context.default !== "undefined" &&
-            context.default !== null
-          )
+            context.default !== null &&
+            !hasExprDefault;
+          if (hasExprDefault || hasFixedDefault) {
             form.values.set_default = true;
+            form.values.default_type = hasExprDefault ? "expression" : "fixed";
+          } else {
+            form.values.default_type = "fixed";
+          }
           return form;
         },
       },
@@ -905,6 +1011,7 @@ router.post(
     await db.withTransaction(async () => {
       await f.delete();
     });
+    await Table.findOne(table_id).update({});
     await getState().refresh_tables();
 
     req.flash("success", req.__(`Field %s deleted`, f.label));
@@ -999,8 +1106,11 @@ router.post(
     let result;
     try {
       if (stored) {
-        const f = get_async_expression_function(formula, fields);
-        result = await f(rows[0]);
+        const f = get_async_expression_function(formula, [
+          ...fields,
+          ...Object.keys(joinFields).map((k) => ({ name: k })),
+        ]);
+        result = await f(rows[0], req.user);
       } else {
         const f = get_expression_function(formula, fields);
         result = f(rows[0]);
@@ -1345,6 +1455,7 @@ router.post(
         undefined,
         req.user
       );
+    if (fv?.fill_options) await fv.fill_options(field);
     if (!fv && field.type === "Key" && fieldview === "select")
       res.send(
         `<input ${

package/routes/files.js

@@ -8,6 +8,7 @@
 const Router = require("express-promise-router");
 const File = require("@saltcorn/data/models/file");
 const User = require("@saltcorn/data/models/user");
+const View = require("@saltcorn/data/models/view");
 const Form = require("@saltcorn/data/models/form");
 const { getState } = require("@saltcorn/data/db/state");
 const s3storage = require("../s3storage");
@@ -21,6 +22,7 @@ const {
   setTenant,
   is_relative_url,
   isAdminOrHasConfigMinRole,
+  safe_redirect,
 } = require("./utils.js");
 const {
   h1,
@@ -120,6 +122,21 @@ router.get(
   error_catcher(async (req, res) => {
     const role = req.user?.role_id ? req.user.role_id : 100;
     const userId = req.user?.id;
+    const min_role_edit_files = getState().getConfig("min_role_edit_files", 1);
+    if (role > min_role_edit_files) {
+      // check if there is a use_picker set
+      let role_needed = min_role_edit_files;
+
+      const all_views = await View.find({}, { cached: true });
+      for (const view of all_views)
+        if (JSON.stringify(view.configuration).includes('"use_picker":true'))
+          role_needed = Math.max(role_needed, view.min_role);
+
+      if (role > role_needed) {
+        res.json({ error: "Not authorized" });
+        return;
+      }
+    }
     const { dir, no_subdirs, file_exts } = req.query;
     const noSubdirs = no_subdirs === "true";
     const safeDir = File.normalise(dir || "/");
@@ -166,10 +183,11 @@ router.get(
       file.location = file.isDirectory ? file.path_to_serve : file.field_value;
     }
     if (file_exts) {
+      const escapeRegex = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
       const re = new RegExp(
         `\\.(${file_exts
           .split(",")
-          .map((s) => s.trim())
+          .map((s) => escapeRegex(s.trim()))
           .join("|")})$`,
         "i"
       );
@@ -470,6 +488,17 @@ router.get(
       const width = strictParseInt(width_str);
       const height =
         height_str && height_str !== "0" ? strictParseInt(height_str) : null;
+      if (
+        file.mimetype === "image/svg+xml" ||
+        file.mimetype === "application/mathml+xml"
+      ) {
+        const window = new JSDOM("").window;
+        const DOMPurify = createDOMPurify(window);
+        const contents = await fs.promises.readFile(file.location);
+        const clean = DOMPurify.sanitize(contents);
+        res.send(clean);
+        return;
+      }
       if (!width) {
         res.sendFile(file.location, { dotfiles: "allow" });
         return;
@@ -687,9 +716,10 @@ router.post(
       req.flash("error", result.error);
     }
     if (!req.xhr)
-      res.redirect(
-        (is_relative_url(redirect) && redirect) ||
-          `/files?dir=${encodeURIComponent(f.current_folder)}`
+      safe_redirect(
+        res,
+        redirect,
+        `/files?dir=${encodeURIComponent(f.current_folder)}`
       );
     else res.json({ success: true });
   })
@@ -878,6 +908,7 @@ const editableExtensions = [
  */
 router.get(
   "/edit/*serve_path",
+  isAdminOrHasConfigMinRole("min_role_edit_files"),
   error_catcher(async (req, res) => {
     const role = req.user && req.user.id ? req.user.role_id : 100;
     const user_id = req.user && req.user.id;
@@ -984,6 +1015,7 @@ router.get(
  */
 router.post(
   "/edit/*serve_path",
+  isAdminOrHasConfigMinRole("min_role_edit_files"),
   error_catcher(async (req, res) => {
     const role = req.user && req.user.id ? req.user.role_id : 100;
     const user_id = req.user && req.user.id;

package/routes/homepage.js

@@ -621,7 +621,10 @@ const get_config_response = async (role_id, res, req) => {
     );
 
     if (contents.html_file) await sendHtmlFile(req, res, contents.html_file);
-    else
+    else if (contents.html_string) {
+      res.set("Content-Type", "text/html");
+      await res.send(contents.html_string);
+    } else
       res.sendWrap(
         {
           title: title || "",

package/routes/list.js

@@ -181,10 +181,11 @@ const typeToGridType = (t, field) => {
       format: "iso",
     };
     jsgField.editor = "__flatpickerEditor";
-    jsgField.formatter = "datetime";
-    jsgField.formatterParams = {
-      inputFormat: "iso",
-    };
+    // jsgField.formatter = "datetime";
+    // jsgField.formatterParams = {
+    //   inputFormat: "iso",
+    // };
+    jsgField.formatter = "__isoDateTimeFormatter";
 
     if (field.attributes?.day_only) {
       jsgField.editorParams = { dayOnly: true };
@@ -293,6 +294,7 @@ router.get(
       hozAlign: "center",
       headerSort: false,
       clipboard: false,
+      frozen: true,
       cellClick: "__delete_tabulator_row",
     });
     const isDark = getState().getLightDarkMode(req.user) === "dark";
@@ -432,30 +434,86 @@ router.get(
                 })
               })
               window.tabulator_table_primary_key = "${table.pk_name}";
+              function tabulator_fill_height() {
+                const el = document.getElementById('jsGrid');
+                if (!el) return 400;
+                return Math.max(200, Math.floor(window.innerHeight - el.getBoundingClientRect().top - 10));
+              }
+              function tabulator_calc_page_size() {
+                const holder = document.querySelector('#jsGrid .tabulator-tableholder');
+                if (!holder) return 20;
+                const rowH = window._tab_row_height || 35;
+                return Math.max(5, Math.floor(holder.clientHeight / rowH));
+              }
+              const _tab_h = tabulator_fill_height();
               window.tabulator_table = new Tabulator("#jsGrid", {
                   ajaxURL:"/api/${encodeURIComponent(
                     table.name
                   )}?tabulator_pagination_format=true${
                     table.versioned ? "&versioncount=on" : ""
-                  }",                   
-                  layout:"fitData", 
+                  }",
+                  layout:"fitDataFill",
                   columns,
-                  height:"100%",
+                  height: _tab_h,
                   pagination:true,
                   paginationMode:"remote",
-                  paginationSize:20,
-                  clipboard:true,                 
+                  paginationSize: tabulator_calc_page_size(),
+                  clipboard:true,
+                  /*clipboardCopyRowRange:"range",
+                  clipboardPasteParser:"range",
+                  clipboardPasteAction:"range",
+                  clipboardCopyConfig:{
+                      rowHeaders:false, //do not include row headers in clipboard output
+                      columnHeaders:false, //do not include column headers in clipboard output
+                  },*/
+                  clipboardCopyStyled:false,
                   movableColumns: true,
                   ajaxContentType:"json",
                   sortMode:"remote",
-                  resizableColumnGuide:true,                  
+                  resizableColumnGuide:true,
+                  /*editTriggerEvent:"dblclick",
+                  selectableRange:1,
+                  selectableRangeRows:true,
+                  selectableRangeClearCells:true,*/
+                   persistence:{
+                      columns: [],
+                      sort: true,
+                  }, 
+                  persistenceID:"scadmintable${encodeURIComponent(
+                    table.id || table.name
+                  )}",
                   columnDefaults:{
                       resizable:true,
                       maxWidth:500
                   },
                   initialSort:[
                     {column:"${table.pk_name}", dir:"asc"},
-                  ],                 
+                  ],
+              });
+              window.tabulator_table.on("tableBuilt", function() {
+                const ps = tabulator_calc_page_size();
+                if (ps !== window.tabulator_table.getPageSize())
+                  window.tabulator_table.setPageSize(ps);
+              });
+              window.tabulator_table.on("dataLoaded", function() {
+                if (window._tab_row_height) return;
+                const rows = window.tabulator_table.getRows();
+                if (!rows.length) return;
+                window._tab_row_height = rows[0].getElement().offsetHeight;
+                const ps = tabulator_calc_page_size();
+                if (ps !== window.tabulator_table.getPageSize())
+                  window.tabulator_table.setPageSize(ps);
+              });
+              let _tab_resize_timer;
+              window.addEventListener('resize', function() {
+                clearTimeout(_tab_resize_timer);
+                _tab_resize_timer = setTimeout(function() {
+                  const h = tabulator_fill_height();
+                  window.tabulator_table.setHeight(h);
+                  const ps = tabulator_calc_page_size();
+                  if (ps !== window.tabulator_table.getPageSize())
+                    window.tabulator_table.setPageSize(ps);
+                }, 150);
               });
               window.allnonecols= (do_show, e) =>{
                 columns.forEach(col=>{

package/routes/packs.js

@@ -22,7 +22,6 @@ const Tag = require("@saltcorn/data/models/tag");
 const EventLog = require("@saltcorn/data/models/eventlog");
 const Model = require("@saltcorn/data/models/model");
 const ModelInstance = require("@saltcorn/data/models/model_instance");
-const load_plugins = require("../load_plugins");
 const { getState } = require("@saltcorn/data/db/state");
 const db = require("@saltcorn/data/db/index");
 const { instanceOfPack } = require("@saltcorn/types/base_types");
@@ -464,7 +463,7 @@ router.post(
     } else {
       await db.withTransaction(async () => {
         await install_pack(pack, undefined, (p) =>
-          load_plugins.loadAndSaveNewPlugin(p)
+          Plugin.loadAndSaveNewPlugin(p)
         );
       });
       await getState().refresh();
@@ -502,7 +501,7 @@ router.post(
     }
     await db.withTransaction(async () => {
       await install_pack(pack.pack, name, (p) =>
-        load_plugins.loadAndSaveNewPlugin(p)
+        Plugin.loadAndSaveNewPlugin(p)
       );
     });
     await getState().refresh();

package/routes/page.js

@@ -75,7 +75,24 @@ const runPage = async (page, req, res, tic) => {
     if (contents.html_file) await sendHtmlFile(req, res, contents.html_file);
     else if (contents.html_string) {
       res.set("Content-Type", "text/html");
-      await res.send(contents.html_string);
+      const state = getState();
+      const version_tag = db.connectObj.version_tag;
+      const locale = req.getLocale?.();
+      const scGlobals =
+        `<script>var _sc_globalCsrf = ${JSON.stringify(req.csrfToken())}` +
+        `, _sc_version_tag = ${JSON.stringify(version_tag)}` +
+        (locale ? `, _sc_locale = ${JSON.stringify(locale)}` : "") +
+        `, _sc_pageloadtag = Math.floor(Math.random() * 16777215).toString(16)` +
+        (req?.user?.role_id === 1 ? `, _sc_is_admin = true` : "") +
+        `;</script>`;
+      const normalized = contents.html_string.replace(
+        /\/static_assets\/[a-f0-9]+\//g,
+        `/static_assets/${version_tag}/`
+      );
+      const html = normalized.includes("</head>")
+        ? normalized.replace("</head>", `${scGlobals}</head>`)
+        : scGlobals + normalized;
+      await res.send(html);
     } else
       res.sendWrap(
         {

package/routes/pageedit.js

@@ -265,6 +265,7 @@ const pageBuilderData = async (req, context) => {
   //console.log(fixed_state_fields.ListTasks);
   const icons = getState().icons;
   return {
+    isRTL: req.isRTL,
     translations:
       req.getLocale() === "en" ? {} : req.getCatalog(req.getLocale()) || {},
     views: views.map((v) => v.select_option),