@saltcorn/server 1.6.0-beta.1 → 1.6.0-beta.10

package/routes/plugins.js

@@ -34,7 +34,8 @@ const {
   plugin_viewtemplates_info_card,
   showRepository,
 } = require("../markup/plugin-store");
-const load_plugins = require("../load_plugins");
+const MarkdownIt = require("markdown-it"),
+  md = new MarkdownIt();
 const {
   h5,
   a,
@@ -57,6 +58,8 @@ const {
   text,
   script,
   domReady,
+  details,
+  summary,
 } = require("@saltcorn/markup/tags");
 const { search_bar } = require("@saltcorn/markup/helpers");
 const fs = require("fs");
@@ -68,7 +71,6 @@ const {
   removeNonWordChars,
   getFetchProxyOptions,
 } = require("@saltcorn/data/utils");
-const { loadAllPlugins } = require("../load_plugins");
 const npmFetch = require("npm-registry-fetch");
 const PluginInstaller = require("@saltcorn/plugins-loader/plugin_installer");
 const {
@@ -191,7 +193,17 @@ const get_store_items = async (req) => {
   if (msgs.length > 0) req.flash("warning", msgs.join("<br>"));
   const packs_available = await fetch_available_packs();
   const packs_installed = getState().getConfig("installed_packs", []);
-  const installed_plugin_names = installed_plugins.map((p) => p.name);
+  const tenants_install_git = getRootState().getConfig(
+    "tenants_install_git",
+    false
+  );
+  const isGitBlocked = (p) =>
+    !isRoot &&
+    !tenants_install_git &&
+    (p.source === "git" || p.source === "github");
+  const installed_plugin_names = installed_plugins
+    .filter((p) => !isGitBlocked(p))
+    .map((p) => p.name);
   const store_plugin_names = instore.map((p) => p.name);
   const plugins_item = instore
     .map((plugin) => ({
@@ -200,6 +212,7 @@ const get_store_items = async (req) => {
       plugin: true,
       description: plugin.description,
       documentation_link: plugin.documentation_link,
+      contents: plugin.contents,
       has_theme: plugin.has_theme,
       has_auth: plugin.has_auth,
       unsafe: plugin.unsafe,
@@ -210,7 +223,12 @@ const get_store_items = async (req) => {
     }))
     .filter((p) => !p.unsafe || isRoot || tenants_unsafe_plugins);
   const local_logins = installed_plugins
-    .filter((p) => !store_plugin_names.includes(p.name) && p.name !== "base")
+    .filter(
+      (p) =>
+        !store_plugin_names.includes(p.name) &&
+        p.name !== "base" &&
+        !isGitBlocked(p)
+    )
     .map((plugin) => ({
       name: plugin.name,
       installed: true,
@@ -310,6 +328,9 @@ const store_item_html = (req) => (item) => ({
       item.ready_for_mobile && badge(req.__("Mobile"))
     ),
     div(item.description || ""),
+    item.contents
+      ? details(summary(req.__("Detailed contents")), md.render(item.contents))
+      : "",
     item.documentation_link
       ? div(
           a(
@@ -454,7 +475,11 @@ const match_string = (s, q) => {
  * @returns {boolean}
  */
 const satisfy_q = (p, q) => {
-  return match_string(p.name, q) || match_string(p.description, q);
+  return (
+    match_string(p.name, q) ||
+    match_string(p.description, q) ||
+    match_string(p.contents, q)
+  );
 };
 
 /**
@@ -663,7 +688,7 @@ router.get(
         const tags = pkgInfo["dist-tags"] || {};
         let selected = null;
         if (getState().plugins[plugin.name]) {
-          const mod = await load_plugins.requirePlugin(plugin);
+          const mod = await Plugin.requirePlugin(plugin);
           if (mod) selected = mod.version;
         }
         if (!selected) selected = versions[versions.length - 1];
@@ -702,7 +727,8 @@ router.get(
                       label: version,
                       selected: version === selected,
                     })
-                  ).reverse()
+                  )
+                  .reverse()
               ),
               // tag
               label(
@@ -929,7 +955,7 @@ router.post(
       const newCfg = wfres.cleanup ? wfres.context : wfres;
       plugin.configuration = newCfg;
       await plugin.upsert();
-      await load_plugins.loadPlugin(plugin);
+      await Plugin.loadPlugin(plugin);
       const instore = await Plugin.store_plugins_available();
       const store_plugin = instore.find((p) => p.name === plugin.name);
       if (store_plugin && store_plugin.has_auth) flash_restart(req);
@@ -967,7 +993,7 @@ router.post(
           ...step.renderForm.values,
         };
         await plugin.upsert();
-        await load_plugins.loadPlugin(plugin);
+        await Plugin.loadPlugin(plugin);
 
         getState().processSend({
           refresh_plugin_cfg: plugin.name,
@@ -1266,7 +1292,7 @@ router.get(
       res.redirect("/plugins");
       return;
     }
-    const mod = await load_plugins.requirePlugin(plugin_db);
+    const mod = await Plugin.requirePlugin(plugin_db);
     const store_items = await get_store_items(req);
     const store_item = store_items.find((item) => item.name === name);
     const update_permitted = plugin_db.source === "npm";
@@ -1274,16 +1300,17 @@ router.get(
     let latest =
       update_permitted &&
       (await get_latest_npm_version(plugin_db.location, 1000));
-    let engineInfos = await load_plugins.getEngineInfos(plugin_db); // with cache
+    let isNpm = plugin_db.source === "npm";
+    let engineInfos = await Plugin.getEngineInfos(plugin_db); // with cache
     let forceFetch = true;
-    if (latest && !engineInfos[latest]) {
-      engineInfos = await load_plugins.getEngineInfos(plugin_db, forceFetch);
+    if (latest && !engineInfos[latest] && isNpm) {
+      engineInfos = await Plugin.getEngineInfos(plugin_db, forceFetch);
       forceFetch = false;
     }
     if (latest && !isVersionSupported(latest, engineInfos)) {
       latest = supportedVersion(
         latest,
-        await load_plugins.getEngineInfos(plugin_db, forceFetch)
+        await Plugin.getEngineInfos(plugin_db, forceFetch)
       );
     }
     const can_update = update_permitted && latest && mod.version !== latest;
@@ -1358,6 +1385,12 @@ router.get(
               )
             )
           : null,
+        store_item && store_item.contents
+          ? tr(
+              th(req.__("Detailed contents")),
+              td(md.render(store_item.contents))
+            )
+          : null,
         pkgjson && pkgjson.repository
           ? tr(th(req.__("Repository")), td(showRepository(pkgjson.repository)))
           : null
@@ -1432,7 +1465,7 @@ router.get(
     const schema = db.getTenantSchema();
     if (schema === db.connectObj.default_schema) {
       await upgrade_all_tenants_plugins((p, f, forceFetch) =>
-        load_plugins.loadPlugin(p, f, forceFetch)
+        Plugin.loadPlugin(p, f, forceFetch)
       );
       req.flash(
         "success",
@@ -1444,11 +1477,11 @@ router.get(
       const installed_plugins = await Plugin.find({});
       for (const plugin of installed_plugins) {
         await plugin.upgrade_version((p, f, forceFetch) =>
-          load_plugins.loadPlugin(p, f, forceFetch)
+          Plugin.loadPlugin(p, f, forceFetch)
         );
       }
       req.flash("success", req.__(`Modules up-to-date`));
-      await restart_tenant(loadAllPlugins);
+      await restart_tenant(Plugin.loadAllPlugins);
       getState().processSend({
         restart_tenant: true,
         tenant: db.getTenantSchema(),
@@ -1495,10 +1528,10 @@ router.get(
     const { name } = req.params;
 
     const plugin = await Plugin.findOne({ name });
-    const versions = await load_plugins.getEngineInfos(plugin, true);
+    const versions = await Plugin.getEngineInfos(plugin, true);
 
     await plugin.upgrade_version(
-      (p, f) => load_plugins.loadPlugin(p, f),
+      (p, f) => Plugin.loadPlugin(p, f),
       supportedVersion("latest", versions, require("../package.json").version)
     );
     req.flash("success", req.__(`Module up-to-date`));
@@ -1531,7 +1564,7 @@ router.post(
       res.redirect(`/plugins`);
     } else {
       try {
-        const msgs = await load_plugins.loadAndSaveNewPlugin(
+        const msgs = await Plugin.loadAndSaveNewPlugin(
           plugin,
           schema === db.connectObj.default_schema || plugin.source === "github"
         );
@@ -1639,7 +1672,7 @@ router.post(
 
     let msgs = null;
     try {
-      msgs = await load_plugins.loadAndSaveNewPlugin(
+      msgs = await Plugin.loadAndSaveNewPlugin(
         plugin,
         forceReInstall,
         undefined,
@@ -1679,3 +1712,5 @@ router.post(
     }
   })
 );
+
+router.get_store_items = get_store_items;

package/routes/scapi.js

@@ -31,7 +31,6 @@ const {
   add_tenant,
 } = require("@saltcorn/data/db/state");
 const db = require("@saltcorn/data/db");
-const { loadAllPlugins } = require("../load_plugins");
 const { text } = require("@saltcorn/markup/tags");
 
 /**
@@ -346,7 +345,7 @@ router.post(
           if (new_tenant) {
             add_tenant(new_tenant);
 
-            await db.runWithTenant(new_tenant, loadAllPlugins);
+            await db.runWithTenant(new_tenant, Plugin.loadAllPlugins);
 
             process_send({ createTenant: new_tenant });
           }

package/routes/sync.js

@@ -5,6 +5,10 @@ const { getState } = require("@saltcorn/data/db/state");
 const Table = require("@saltcorn/data/models/table");
 const File = require("@saltcorn/data/models/file");
 const { getSafeSaltcornCmd } = require("@saltcorn/data/utils");
+const {
+  freeVariables,
+  add_free_variables_to_joinfields,
+} = require("@saltcorn/data/models/expression");
 const { spawn, spawnSync } = require("child_process");
 const path = require("path");
 const fs = require("fs").promises;
@@ -14,6 +18,7 @@ module.exports = router;
 
 router.get(
   "/sync_timestamp",
+  loggedIn,
   error_catcher(async (req, res) => {
     try {
       res.json({ syncTimestamp: (await db.time()).valueOf() });
@@ -24,6 +29,34 @@ router.get(
   })
 );
 
+// Apply ownership_formula filter to rows fetched by getSyncRows.
+// For formulas that reference join fields, resolves them via a second
+// getJoinedRows pass bounded to the PKs already in the result set.
+const applyOwnershipFormula = async (rows, table, user) => {
+  if (!rows.length) return rows;
+  const pkName = table.pk_name;
+  const joinFields = {};
+  add_free_variables_to_joinfields(
+    freeVariables(table.ownership_formula),
+    joinFields,
+    table.getFields()
+  );
+  let rowMap = null;
+  if (Object.keys(joinFields).length > 0) {
+    const pks = rows.map((r) => r[pkName]);
+    const joinedRows = await table.getJoinedRows({
+      where: { [pkName]: { in: pks } },
+      joinFields,
+    });
+    rowMap = Object.fromEntries(joinedRows.map((r) => [r[pkName], r]));
+  }
+  // table.ownership_formula
+  return rows.filter((row) => {
+    const evalRow = rowMap ? rowMap[row[pkName]] ?? row : row;
+    return table.is_owner(user, evalRow);
+  });
+};
+
 const getSyncRows = async (syncInfo, table, syncUntil, user) => {
   const tblName = table.name;
   const pkName = table.pk_name;
@@ -48,64 +81,101 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
     }
     ownerFieldName = ownerField.name;
   }
+
+  // Time-based composite cursor: (lastModifiedAt ms, lastRef string).
+  // Works for both integer and UUID primary keys.
+  const lastModifiedAt = Number(syncInfo.lastModifiedAt ?? 0);
+  if (!Number.isInteger(lastModifiedAt) || lastModifiedAt < 0)
+    throw new Error("Invalid lastModifiedAt");
+  const lastRef = String(syncInfo.lastRef ?? "");
+
+  const syncUntilMs = new Date(syncUntil).valueOf();
+  if (!Number.isFinite(syncUntilMs)) throw new Error("Invalid syncUntil");
+
+  const userId = user?.id !== undefined ? parseInt(user.id, 10) : null;
+  if (ownerFieldName && !Number.isFinite(userId))
+    throw new Error("Invalid user id");
+
   const schema = db.getTenantSchemaPrefix();
   if (!syncInfo.syncFrom) {
+    // First sync: all non-deleted rows after the cursor, ordered by
+    // (last_modified, ref) so pagination is stable across PK types.
+    const params = [lastModifiedAt / 1000.0, lastRef];
+    const ownerClause = ownerFieldName
+      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $3`
+      : "";
+    if (ownerFieldName) params.push(userId);
     const { rows } = await db.query(
-      `select 
-         info_tbl.ref "_sync_info_tbl_ref_", 
-         info_tbl.last_modified "_sync_info_tbl_last_modified_", 
-         info_tbl.deleted "_sync_info_tbl_deleted_",
+      `select
+         COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text) "_sync_info_tbl_ref_",
+         info_tbl.last_modified "_sync_info_tbl_last_modified_",
+         COALESCE(info_tbl.deleted, false) "_sync_info_tbl_deleted_",
          data_tbl.*
-       from ${schema}"${db.sqlsanitize(
-         tblName
-       )}_sync_info" "info_tbl" right join "${db.sqlsanitize(
-         tblName
-       )}" "data_tbl"
-      on info_tbl.ref = data_tbl."${db.sqlsanitize(
-        pkName
-      )}" and info_tbl.deleted = false
-      where data_tbl."${db.sqlsanitize(pkName)}" > ${syncInfo.maxLoadedId}
-      ${ownerFieldName ? `and data_tbl."${ownerFieldName}" = ${user.id}` : ""}
-      order by data_tbl."${db.sqlsanitize(pkName)}"`
+       from ${schema}"${db.sqlsanitize(tblName)}_sync_info" "info_tbl"
+       right join "${db.sqlsanitize(tblName)}" "data_tbl"
+         on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"::text
+         and info_tbl.deleted = false
+       where (
+           COALESCE(info_tbl.last_modified, to_timestamp(0)),
+           COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text)
+         ) > (to_timestamp($1), $2)
+       ${ownerClause}
+       order by
+         COALESCE(info_tbl.last_modified, to_timestamp(0)),
+         COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text)`,
+      params
     );
     for (const row of rows) {
       if (row._sync_info_tbl_last_modified_)
         row._sync_info_tbl_last_modified_ =
           row._sync_info_tbl_last_modified_.valueOf();
-      else row._sync_info_tbl_last_modified_ = new Date(syncUntil).valueOf();
+      else row._sync_info_tbl_last_modified_ = syncUntilMs;
       row._sync_info_tbl_ref_ = row[pkName];
     }
+    if (table.ownership_formula && role > minRole)
+      return applyOwnershipFormula(rows, table, user);
     return rows;
   } else {
+    const syncFromMs = new Date(syncInfo.syncFrom).valueOf();
+    if (!Number.isFinite(syncFromMs)) throw new Error("Invalid syncFrom");
+
+    // Incremental sync: rows changed in the time window, paged by
+    // (last_modified, ref) within the window.
+    const params = [
+      syncFromMs / 1000.0,
+      syncUntilMs / 1000.0,
+      lastModifiedAt / 1000.0,
+      lastRef,
+    ];
+    const ownerClause = ownerFieldName
+      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $5`
+      : "";
+    if (ownerFieldName) params.push(userId);
     const { rows } = await db.query(
-      `select 
-         info_tbl.ref "_sync_info_tbl_ref_", 
-         info_tbl.last_modified "_sync_info_tbl_last_modified_", 
+      `select
+         info_tbl.ref "_sync_info_tbl_ref_",
+         info_tbl.last_modified "_sync_info_tbl_last_modified_",
          info_tbl.deleted "_sync_info_tbl_deleted_",
          data_tbl.*
-       from ${schema}"${db.sqlsanitize(
-         tblName
-       )}_sync_info" "info_tbl" join ${schema}"${db.sqlsanitize(
-         tblName
-       )}" "data_tbl"
-      on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"
-      where date_trunc('milliseconds', info_tbl.last_modified) > to_timestamp(${
-        new Date(syncInfo.syncFrom).valueOf() / 1000.0
-      }) 
-      and date_trunc('milliseconds', info_tbl.last_modified) < to_timestamp(${
-        new Date(syncUntil).valueOf() / 1000.0
-      }) 
-      and info_tbl.deleted = false
-      and info_tbl.ref > ${syncInfo.maxLoadedId}
-      ${ownerFieldName ? `and data_tbl."${ownerFieldName}" = ${user.id}` : ""}
-      order by info_tbl.ref`
+       from ${schema}"${db.sqlsanitize(tblName)}_sync_info" "info_tbl"
+       join ${schema}"${db.sqlsanitize(tblName)}" "data_tbl"
+         on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"::text
+       where date_trunc('milliseconds', info_tbl.last_modified) > to_timestamp($1)
+         and date_trunc('milliseconds', info_tbl.last_modified) < to_timestamp($2)
+         and info_tbl.deleted = false
+         and (info_tbl.last_modified, info_tbl.ref) > (to_timestamp($3), $4)
+       ${ownerClause}
+       order by info_tbl.last_modified, info_tbl.ref`,
+      params
     );
     for (const row of rows) {
       if (row._sync_info_tbl_last_modified_)
         row._sync_info_tbl_last_modified_ =
           row._sync_info_tbl_last_modified_.valueOf();
-      else row._sync_info_tbl_last_modified_ = syncUntil.valueOf();
+      else row._sync_info_tbl_last_modified_ = syncUntilMs;
     }
+    if (table.ownership_formula && role > minRole)
+      return applyOwnershipFormula(rows, table, user);
     return rows;
   }
 };
@@ -116,6 +186,7 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
 */
 router.post(
   "/load_changes",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { syncInfos, loadUntil } = req.body || {};
     if (!loadUntil) {
@@ -135,6 +206,8 @@ router.post(
         for (const [tblName, syncInfo] of Object.entries(syncInfos)) {
           const table = Table.findOne({ name: tblName });
           if (!table) throw new Error(`The table '${tblName}' does not exists`);
+          if (!table.has_sync_info)
+            throw new Error(`The table '${tblName}' has no sync info`);
           const pkName = table.pk_name;
           let rows = await getSyncRows(syncInfo, table, loadUntil, req.user);
           if (!rows) continue;
@@ -146,16 +219,18 @@ router.post(
               continue;
             else if (table.ownership_field_id) {
             } else if (table.ownership_formula) {
-              rows = rows.filter((row) => table.is_owner(req.user, row));
+              // already filtered by applyOwnershipFormula inside getSyncRows
             }
           }
           if (rows.length > rowLimit) {
             rows.splice(rowLimit);
           }
           rowLimit -= rows.length;
+          const lastRow = rows.length > 0 ? rows[rows.length - 1] : null;
           result[tblName] = {
             rows,
-            maxLoadedId: rows.length > 0 ? rows[rows.length - 1][pkName] : 0,
+            maxModifiedAt: lastRow ? lastRow._sync_info_tbl_last_modified_ : 0,
+            maxRef: lastRow ? String(lastRow._sync_info_tbl_ref_ ?? "") : "",
           };
         }
         return result;
@@ -168,17 +243,25 @@ router.post(
   })
 );
 
-const getDelRows = async (tblName, syncFrom, syncUntil) => {
+const getDelRows = async (tblName, syncFrom, syncUntil, userId = null) => {
+  const syncFromMs = syncFrom.valueOf();
+  const syncUntilMs = syncUntil.valueOf();
+  if (!Number.isFinite(syncFromMs)) throw new Error("Invalid syncFrom");
+  if (!Number.isFinite(syncUntilMs)) throw new Error("Invalid syncUntil");
   const schema = db.getTenantSchemaPrefix();
+  const ownerFilter =
+    userId !== null ? `and alias.owner_id = ${parseInt(userId)}` : "";
   const dbRes = await db.query(
-    `select * 
+    `select *
      from (
-      select ref, max(last_modified) from ${schema}"${db.sqlsanitize(
-        tblName
-      )}_sync_info" 
-      group by ref, deleted having deleted = true) as alias 
-      where alias.max < to_timestamp(${syncUntil.valueOf() / 1000.0}) 
-        and alias.max > to_timestamp(${syncFrom.valueOf() / 1000.0})`
+      select ref, max(last_modified), owner_id, owner_fields from ${schema}"${db.sqlsanitize(
+      tblName
+    )}_sync_info"
+      group by ref, deleted, owner_id, owner_fields having deleted = true) as alias
+      where alias.max < to_timestamp($1)
+        and alias.max > to_timestamp($2)
+        ${ownerFilter}`,
+    [syncUntilMs / 1000.0, syncFromMs / 1000.0]
   );
   for (const row of dbRes.rows) {
     if (row.last_modified) row.last_modified = row.last_modified.valueOf();
@@ -193,8 +276,10 @@ const getDelRows = async (tblName, syncFrom, syncUntil) => {
 */
 router.post(
   "/deletes",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { syncInfos, syncTimestamp } = req.body || {};
+    const role = req.user ? req.user.role_id : 100;
     try {
       const result = await db.withTransaction(async () => {
         const syncUntil = new Date(syncTimestamp);
@@ -202,6 +287,35 @@ router.post(
           deletes: {},
         };
         for (const [tblName, syncInfo] of Object.entries(syncInfos)) {
+          const table = Table.findOne({ name: tblName });
+          if (!table) throw new Error(`The table '${tblName}' does not exists`);
+          if (!table.has_sync_info)
+            throw new Error(`The table '${tblName}' has no sync info`);
+          if (role > table.min_role_read) {
+            if (!table.ownership_field_id && !table.ownership_formula) continue;
+            if (!syncInfo.syncFrom) continue;
+            if (table.ownership_field_id) {
+              // Filter by owner_id in SQL
+              result.deletes[tblName] = await getDelRows(
+                tblName,
+                new Date(syncInfo.syncFrom),
+                syncUntil,
+                req.user.id
+              );
+            } else {
+              // ownership_formula: fetch all deletes and evaluate formula in JS
+              // against the field values stored in owner_fields at delete time
+              const rows = await getDelRows(
+                tblName,
+                new Date(syncInfo.syncFrom),
+                syncUntil
+              );
+              result.deletes[tblName] = rows.filter((row) =>
+                table.is_owner(req.user, row.owner_fields || {})
+              );
+            }
+            continue;
+          }
           if (syncInfo.syncFrom) {
             result.deletes[tblName] = await getDelRows(
               tblName,
@@ -225,17 +339,19 @@ router.post(
 */
 router.post(
   "/offline_changes",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { changes, newSyncTimestamp, oldSyncTimestamp } = req.body || {};
     const rootFolder = await File.rootFolder();
     try {
       const syncDirName = `${newSyncTimestamp}_${req.user?.email || "public"}`;
-      const syncDir = path.join(
-        rootFolder.location,
-        "mobile_app",
-        "sync",
+      const syncDir = File.normalise_in_base(
+        path.join(rootFolder.location, "mobile_app", "sync"),
         syncDirName
       );
+      if (!syncDir) {
+        return res.status(400).json({ error: "Invalid sync directory name" });
+      }
       await fs.mkdir(syncDir, { recursive: true });
       await fs.writeFile(
         path.join(syncDir, "changes.json"),
@@ -287,16 +403,23 @@ const readOutFile = async (entries, syncDir, fileName) => {
 
 router.get(
   "/upload_finished",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { dir_name } = req.query;
     try {
+      const expectedEmail = req.user?.email || "public";
+      const dirMatch = dir_name ? dir_name.match(/^\d+_(.+)$/) : null;
+      if (!dirMatch || dirMatch[1] !== expectedEmail) {
+        return res.status(403).json({ error: "Access denied" });
+      }
       const rootFolder = await File.rootFolder();
-      const syncDir = path.join(
-        rootFolder.location,
-        "mobile_app",
-        "sync",
+      const syncDir = File.normalise_in_base(
+        path.join(rootFolder.location, "mobile_app", "sync"),
         dir_name
       );
+      if (!syncDir) {
+        return res.json({ finished: false });
+      }
       let entries = null;
       try {
         entries = await fs.readdir(syncDir);
@@ -340,9 +463,15 @@ router.get(
 
 router.post(
   "/clean_sync_dir",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { dir_name } = req.body || {};
     try {
+      const expectedEmail = req.user?.email || "public";
+      const dirMatch = dir_name ? dir_name.match(/^\d+_(.+)$/) : null;
+      if (!dirMatch || dirMatch[1] !== expectedEmail) {
+        return res.status(403).json({ error: "Access denied" });
+      }
       const rootFolder = await File.rootFolder();
       const syncDir = File.normalise_in_base(
         path.join(rootFolder.location, "mobile_app", "sync"),