@saltcorn/server 1.6.0-beta.1 → 1.6.0-beta.11

package/routes/admin.js

@@ -76,19 +76,20 @@ const {
   //get_other_domain_tenant,
   get_process_init_time,
 } = require("@saltcorn/data/db/state");
-const { loadAllPlugins } = require("../load_plugins");
 const {
   create_backup,
   restore,
   auto_backup_now,
 } = require("@saltcorn/admin-models/models/backup");
-const { install_pack } = require("@saltcorn/admin-models/models/pack");
+const {
+  install_pack,
+  filter_pack,
+} = require("@saltcorn/admin-models/models/pack");
 const Snapshot = require("@saltcorn/admin-models/models/snapshot");
 const {
   runConfigurationCheck,
 } = require("@saltcorn/admin-models/models/config-check");
 const fs = require("fs");
-const load_plugins = require("../load_plugins");
 const {
   restore_backup,
   send_admin_page,
@@ -305,6 +306,7 @@ admin_config_route({
     { section_header: "Custom code" },
     "page_custom_css",
     "page_custom_html",
+    "suppress_toasts",
     { section_header: "Updates and module store" },
     "airgap",
     "plugins_store_endpoint",
@@ -489,6 +491,7 @@ router.get(
     "min_role_edit_search",
     "min_role_edit_menu",
     "min_role_edit_files",
+    "min_role_edit_users",
   ]),
   error_catcher(async (req, res) => {
     const { topic } = req.params;
@@ -700,35 +703,14 @@ router.get(
                 { href: "/admin/snapshot-list" },
                 req.__("List/download snapshots »")
               ),
-              form(
+              a(
                 {
-                  method: "post",
-                  action: "/admin/snapshot-restore-full",
-                  encType: "multipart/form-data",
+                  onclick: "ajax_modal('/admin/snapshot-restore-full')",
+                  class: "d-block",
+                  href: `javascript:void(0)`,
                 },
-                input({
-                  type: "hidden",
-                  name: "_csrf",
-                  value: req.csrfToken(),
-                }),
-                label(
-                  {
-                    class: "btn-link",
-                    for: "upload_to_snapshot",
-                    style: { cursor: "pointer" },
-                  },
-                  i({ class: "fas fa-upload me-2 mt-2" }),
-                  req.__("Restore a snapshot")
-                ),
-                input({
-                  id: "upload_to_snapshot",
-                  class: "d-none",
-                  name: "file",
-                  type: "file",
-                  accept: ".json,application/json",
-                  onchange:
-                    "notifyAlert('Restoring snapshot...', true);this.form.submit();",
-                })
+                i({ class: "fas fa-upload me-2 mt-2" }),
+                req.__("Restore a snapshot")
               )
             ),
           },
@@ -908,7 +890,12 @@ router.get(
   ]),
   error_catcher(async (req, res) => {
     const { type, name } = req.params;
-    const snaps = await Snapshot.entity_history(type, name);
+    const snapOffset = parseInt(req.query.snap_offset) || 0;
+    const { history: snaps, hasMore } = await Snapshot.entity_history(
+      type,
+      name,
+      snapOffset
+    );
     const locale = getState().getConfig("default_locale", "en");
     const auth = checkEditPermission(type + "s", req.user);
     if (!auth) {
@@ -916,6 +903,9 @@ router.get(
       return;
     }
     res.set("Page-Title", `Restore ${text(name)}`);
+    let olderUrl = `/admin/snapshot-restore/${type}/${encodeURIComponent(name)}?snap_offset=${snapOffset + 100}`;
+    if (req.query.on_done_redirect)
+      olderUrl += `&on_done_redirect=${encodeURIComponent(req.query.on_done_redirect)}`;
     res.send(
       mkTable(
         [
@@ -946,7 +936,10 @@ router.get(
           },
         ],
         snaps
-      )
+      ) +
+        (hasMore
+          ? `<div class="mt-2 text-center"><button class="btn btn-secondary btn-sm" onclick="ajax_modal('${olderUrl}')">${req.__("Load older snapshots")}</button></div>`
+          : "")
     );
   })
 );
@@ -992,6 +985,69 @@ router.post(
   })
 );
 
+router.get(
+  "/snapshot-restore-full",
+  isAdmin,
+  error_catcher(async (req, res) => {
+    const snapForm = new Form({
+      action: "/admin/snapshot-restore-full",
+      formStyle: "vert",
+      fields: [
+        {
+          name: "file",
+          label: req.__("Snapshot file"),
+          class: "form-control",
+          default: true,
+          type: "File",
+        },
+        {
+          name: "configuration",
+          label: req.__("Configuration"),
+          default: true,
+          type: "Bool",
+        },
+        {
+          name: "site_name",
+          label: req.__("Site name"),
+          type: "Bool",
+          default: true,
+          showIf: { configuration: true },
+        },
+        {
+          name: "base_url",
+          label: req.__("Base URL"),
+          type: "Bool",
+          default: true,
+          showIf: { configuration: true },
+        },
+        {
+          name: "email_settings",
+          label: req.__("Email settings"),
+          type: "Bool",
+          default: true,
+          showIf: { configuration: true },
+        },
+        {
+          name: "ssl_settings",
+          label: req.__("SSL settings"),
+          type: "Bool",
+          default: true,
+          showIf: { configuration: true },
+        },
+        {
+          name: "modules",
+          label: req.__("Modules"),
+          default: true,
+          type: "Bool",
+        },
+      ],
+    });
+    res.sendWrap(`Restore snapshot`, {
+      above: [renderForm(snapForm, req.csrfToken())],
+    });
+  })
+);
+
 /**
  * @name post/restore
  * @function
@@ -1005,9 +1061,10 @@ router.post(
     if (req.files?.file?.tempFilePath) {
       try {
         const pack = JSON.parse(fs.readFileSync(req.files?.file?.tempFilePath));
+        filter_pack(pack, req.body);
         await db.withTransaction(async () => {
           await install_pack(pack, undefined, (p) =>
-            load_plugins.loadAndSaveNewPlugin(p)
+            Plugin.loadAndSaveNewPlugin(p)
           );
         });
         await getState().refresh();
@@ -1647,7 +1704,7 @@ router.post(
       if (process.send) getState().processSend("RestartServer");
       else process.exit(0);
     } else {
-      await restart_tenant(loadAllPlugins);
+      await restart_tenant(Plugin.loadAllPlugins);
       getState().processSend({
         restart_tenant: true,
         tenant: db.getTenantSchema(),
@@ -2028,9 +2085,7 @@ router.post(
   error_catcher(async (req, res) => {
     const newPath = File.get_new_path();
     await req.files.file.mv(newPath);
-    const err = await restore(newPath, (p) =>
-      load_plugins.loadAndSaveNewPlugin(p)
-    );
+    const err = await restore(newPath, (p) => Plugin.loadAndSaveNewPlugin(p));
     if (err) req.flash("error", err);
     else req.flash("success", req.__("Successfully restored backup"));
     await getState().refresh_plugins();
@@ -4549,6 +4604,54 @@ router.post(
   })
 );
 
+/**
+ * Validate synced tables: check that all tables reachable via FK from the
+ * selected synced tables are also included in the synced set.
+ */
+router.post(
+  "/build-mobile-app/validate-synced-tables",
+  isAdmin,
+  error_catcher(async (req, res) => {
+    const { synchedTables } = req.body || {};
+    if (!Array.isArray(synchedTables) || synchedTables.length === 0) {
+      return res.json({ warnings: [] });
+    }
+
+    const syncedSet = new Set(synchedTables);
+    const visited = new Set();
+    const queue = [...synchedTables];
+    const missing = new Set();
+
+    while (queue.length > 0) {
+      const tblName = queue.shift();
+      if (visited.has(tblName)) continue;
+      visited.add(tblName);
+
+      const table = Table.findOne({ name: tblName });
+      if (!table) continue;
+
+      for (const field of table.getFields()) {
+        if (field.reftable_name && !field.calculated) {
+          const refName = field.reftable_name;
+          if (refName === "users") continue;
+          if (!syncedSet.has(refName)) {
+            missing.add(refName);
+          }
+          if (!visited.has(refName)) {
+            queue.push(refName);
+          }
+        }
+      }
+    }
+
+    const warnings = [...missing].map(
+      (tblName) =>
+        `Table "${tblName}" is referenced by a synced table but is not itself synced.`
+    );
+    res.json({ warnings });
+  })
+);
+
 /**
  * Do Build Mobile App
  */
@@ -5253,7 +5356,8 @@ router.get(
 declare var console: Console;
 function setTimeout(f:Function, timeout?:number)
 declare const page_load_tag: string
-function emit_to_client(message: object, to_user_ids?: number | number[])
+function emit_to_client(message: object, to_user_ids?: number | number[] | null)
+function emitEvent(eventType: ${Trigger.when_options.map((o) => `"${o}"`).join(" | ")}, channel?: string, payload?: any)
 async function sleep(milliseconds: number)
 function interpolate(s: string,
   row: Row,
@@ -5364,7 +5468,7 @@ async function refreshSystemCache(entities?: "codepages" | "tables" | "views" |
             }
           });
         };
-        addTsFields(table, "", 2);
+        addTsFields(table, "", req.query.nojoins ? -1 : 2);
         ds.push(`declare const table: Table`);
         ds.push(`declare const row: {
          ${tsFields.join("\n")}
@@ -5632,7 +5736,11 @@ router.post(
       //ignore
     }
     try {
-      res.json({ success: true, code: stripTypes(`async () =>{${code}}`) });
+      res.json({
+        success: true,
+        code: stripTypes(`async () =>{${code}
+}`),
+      });
     } catch (error) {
       res.json({ success: false, error: error.message });
     }

package/routes/api.js

@@ -68,13 +68,13 @@ const limitFields = (fields) => (r) => {
 };
 
 /**
- * Check that user has right to read table data (only read in terms of CRUD)
+ * Check that user potentially has right to read table data (only read in terms of CRUD). In case of ownership fields/formula, further checks are needed.
  * @param {object} req httprequest
  * @param {object} user - user based on access token
  * @param {Table} table
  * @returns {boolean}
  */
-function accessAllowedRead(req, user, table, allow_ownership) {
+function potentiallyAccessAllowedRead(req, user, table, allow_ownership) {
   const role =
     req.user && req.user.id
       ? req.user.role_id
@@ -91,13 +91,13 @@ function accessAllowedRead(req, user, table, allow_ownership) {
 }
 
 /**
- * Check that user has right to write table data (create, update, delete in terms of  CRUD)
+ * Check that user potentially has right to write table data (create, update, delete in terms of  CRUD). In case of ownership fields/formula, further checks are needed.
  * @param {object} req httprequest
  * @param {object} user user based on access token
  * @param {Table} table
  * @returns {boolean}
  */
-function accessAllowedWrite(req, user, table) {
+function potentiallyAccessAllowedWrite(req, user, table) {
   const role =
     req.user && req.user.id
       ? req.user.role_id
@@ -278,7 +278,8 @@ router.post(
             folder ? File.normalise(folder) : undefined
           );
           const many = Array.isArray(f);
-          const formatLocation = (fl) => File.fieldValueFromRelative(fl.path_to_serve);
+          const formatLocation = (fl) =>
+            File.fieldValueFromRelative(fl.path_to_serve);
           const formatUrl = (loc, filename) =>
             File.pathToServeUrl(loc, { filename });
           jsonResp = {
@@ -288,9 +289,7 @@ router.post(
                 ? f.map((fl) => formatLocation(fl))
                 : formatLocation(f),
               url: many
-                ? f.map((fl) =>
-                    formatUrl(formatLocation(fl), fl.filename)
-                  )
+                ? f.map((fl) => formatUrl(formatLocation(fl), fl.filename))
                 : formatUrl(formatLocation(f), f.filename),
             },
           };
@@ -326,7 +325,8 @@ router.get(
       "api-bearer",
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedRead(req, user, table)) {
+        if (potentiallyAccessAllowedRead(req, user, table)) {
+          const myReq = { user: user || req.user, __: req.__ };
           const field = table.getFields().find((f) => f.name === fieldName);
           if (!field) {
             res.status(404).json({ error: req.__("Not found") });
@@ -337,9 +337,9 @@ router.get(
             field.is_fkey ||
             (field.type.name === "String" && field.attributes?.options)
           ) {
-            dvs = await field.distinct_values();
+            dvs = await field.distinct_values(myReq);
           } else {
-            dvs = await table.distinctValues(fieldName);
+            dvs = await table.distinctValues(fieldName, {}, user || req.user);
           }
           res.json({ success: dvs });
         } else {
@@ -442,7 +442,7 @@ router.get(
       ["api-bearer", "jwt"],
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedRead(req, user, table, true)) {
+        if (potentiallyAccessAllowedRead(req, user, table, true)) {
           let rows;
           if (versioncount === "on") {
             const joinOpts = {
@@ -472,6 +472,7 @@ router.get(
               state: req_query,
               table,
               prefix: "a.",
+              user: req.user || user,
             });
             const joinFields = {};
             const derefs = Array.isArray(dereference)
@@ -526,50 +527,56 @@ router.get(
   })
 );
 
-router.get("/:tableName/count", async (req, res, next) => {
-  const { tableName } = req.params;
-  const { approximate, ...req_query } = req.query;
+router.get(
+  "/:tableName/count",
+  error_catcher(async (req, res, next) => {
+    const { tableName } = req.params;
+    const { approximate, ...req_query } = req.query;
 
-  const table = Table.findOne(
-    strictParseInt(tableName)
-      ? { id: strictParseInt(tableName) }
-      : { name: tableName }
-  );
-  if (!table) {
-    getState().log(3, `API get ${tableName} table not found`);
-    res.status(404).json({ error: req.__("Not found") });
-    return;
-  }
-  await passport.authenticate(
-    ["api-bearer", "jwt"],
-    { session: false },
-    async function (err, user, info) {
-      if (accessAllowedRead(req, user, table)) {
-        const tbl_fields = table.getFields();
-        readState(req_query, tbl_fields, req);
-        const qstate = stateFieldsToWhere({
-          fields: tbl_fields,
-          approximate: !!approximate,
-          state: req_query,
-          table,
-          prefix: "a.",
-        });
-        const count = await table.countRows(qstate);
-        res.json({ success: count });
-      } else {
-        getState().log(3, `API get ${table.name} not authorized`);
-        res.status(401).json({ error: req.__("Not authorized") });
-      }
+    const table = Table.findOne(
+      strictParseInt(tableName)
+        ? { id: strictParseInt(tableName) }
+        : { name: tableName }
+    );
+    if (!table) {
+      getState().log(3, `API get ${tableName} table not found`);
+      res.status(404).json({ error: req.__("Not found") });
+      return;
     }
-  )(req, res, next);
-});
+    await passport.authenticate(
+      ["api-bearer", "jwt"],
+      { session: false },
+      async function (err, user, info) {
+        if (potentiallyAccessAllowedRead(req, user, table)) {
+          const tbl_fields = table.getFields();
+          readState(req_query, tbl_fields, req);
+          const qstate = stateFieldsToWhere({
+            fields: tbl_fields,
+            approximate: !!approximate,
+            state: req_query,
+            table,
+            prefix: "a.",
+            user: req.user || user,
+          });
+          const count = await table.countRows(qstate);
+          res.json({ success: count });
+        } else {
+          getState().log(3, `API get ${table.name} not authorized`);
+          res.status(401).json({ error: req.__("Not authorized") });
+        }
+      }
+    )(req, res, next);
+  })
+);
 
 /**
  * Emit Event using POST
  * This is used from the mobile app to send an event to the server.
  *
- * The user comes the JWT token and actions,
- * listening for the event, have to check on their own if the user is allowed to run it.
+ * Authenticated users may only emit events listed in the
+ * `mobile_emit_allowed_events` config.
+ * Public users (role_id=100, no id) may only emit events listed in the
+ * `mobile_emit_public_events` config (default: empty — disabled).
  */
 router.post(
   "/emit-event/:eventname",
@@ -578,15 +585,44 @@ router.post(
       "jwt",
       { session: false },
       async function (err, user, info) {
-        if (user) {
-          const { eventname } = req.params;
-          const { channel, payload } = req.body;
-          Trigger.emitEvent(eventname, channel, user, payload);
-          res.json({ success: true });
-        } else {
+        if (!user) {
           getState().log(3, `API POST emit-event not authorized`);
-          res.status(401).json({ error: req.__("Not authorized") });
+          return res.status(401).json({ error: req.__("Not authorized") });
+        }
+        const { eventname } = req.params;
+        const { channel, payload } = req.body;
+        const state = getState();
+        if (!user.id) {
+          // public user — only allowed if explicitly configured
+          const publicAllowed = state.getConfig(
+            "mobile_emit_public_events",
+            []
+          );
+          if (!publicAllowed.includes(eventname)) {
+            state.log(3, `API POST emit-event not authorized for public user`);
+            return res.status(401).json({ error: req.__("Not authorized") });
+          }
+        } else {
+          // authenticated user — ReceiveMobileShareData always allowed, rest requires config
+          const configAllowed = state.getConfig(
+            "mobile_emit_allowed_events",
+            []
+          );
+          if (
+            eventname !== "ReceiveMobileShareData" &&
+            !configAllowed.includes(eventname)
+          ) {
+            state.log(
+              3,
+              `API POST emit-event: event type '${eventname}' not allowed`
+            );
+            return res
+              .status(403)
+              .json({ error: req.__("Event type not allowed") });
+          }
         }
+        Trigger.emitEvent(eventname, channel, user, payload);
+        res.json({ success: true });
       }
     )(req, res, next);
   })
@@ -700,7 +736,7 @@ router.post(
       "api-bearer",
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedWrite(req, user, table)) {
+        if (potentiallyAccessAllowedWrite(req, user, table)) {
           const { _versions, ...row } = req.body || {};
           const fields = table.getFields();
           readState(row, fields, req);
@@ -754,7 +790,7 @@ router.post(
       "api-bearer",
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedWrite(req, user, table)) {
+        if (potentiallyAccessAllowedWrite(req, user, table)) {
           try {
             await db.withTransaction(async () => {
               if (id === "undefined") {
@@ -807,7 +843,7 @@ router.post(
       ["api-bearer", "jwt"],
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedWrite(req, user, table)) {
+        if (potentiallyAccessAllowedWrite(req, user, table)) {
           const { _versions, ...row } = req.body || {};
           const fields = table.getFields();
           readState(row, fields, req);
@@ -862,7 +898,7 @@ router.delete(
       "api-bearer",
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedWrite(req, user, table)) {
+        if (potentiallyAccessAllowedWrite(req, user, table)) {
           try {
             //await db.withTransaction(async () => {
             if (id === "undefined") {

package/routes/delete.js

@@ -6,7 +6,7 @@
 
 const Router = require("express-promise-router");
 
-const { error_catcher, is_relative_url } = require("./utils.js");
+const { error_catcher, is_relative_url, safe_redirect } = require("./utils.js");
 const Table = require("@saltcorn/data/models/table");
 const { readState } = require("@saltcorn/data/plugin-helper");
 const {
@@ -86,10 +86,7 @@ router.post(
     }
     if (req.xhr) {
       res.json({ success, ...resultCollector });
-    } else
-      res.redirect(
-        (is_relative_url(redirect) && redirect) || `/list/${table.name}`
-      );
+    } else safe_redirect(res, redirect, `/list/${table.name}`);
   })
 );
 router.post(

package/routes/edit.js

@@ -6,7 +6,7 @@
 
 const Router = require("express-promise-router");
 
-const { error_catcher, is_relative_url } = require("./utils.js");
+const { error_catcher, is_relative_url, safe_redirect } = require("./utils.js");
 const Table = require("@saltcorn/data/models/table");
 
 /**
@@ -46,9 +46,6 @@ router.post(
 
     if (req.xhr) res.send("OK");
     else if (req.get("referer")) res.redirect(req.get("referer"));
-    else
-      res.redirect(
-        (is_relative_url(redirect) && redirect) || `/list/${table.name}`
-      );
+    else safe_redirect(res, redirect, `/list/${table.name}`);
   })
 );