@saltcorn/server 1.6.0-beta.2 → 1.6.0-beta.4

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## 1.6.0 - In development
 
+* User roles below admin can now be given permission to edit users with the same user interface as that used by admin (at /useradmin URLs).
+
 * In the `relative` fieldview for date fields, the full time is shown when on hover (using the title attribute)
 
 * Typescript types are now stripped from run_js_code actions and code pages (if on Node.js 22.13.0 or later)

package/app.js

@@ -359,6 +359,9 @@ const getApp = async (opts = {}) => {
   passport.use(
     new JwtStrategy(jwtOpts, async (jwt_payload, done) => {
       const userCheck = async () => {
+        if (jwt_payload.sub === "public") {
+          return done(null, { role_id: 100 });
+        }
         const u = await User.findOne({ email: jwt_payload.sub });
         if (
           u &&
@@ -369,7 +372,7 @@ const getApp = async (opts = {}) => {
         ) {
           return done(null, u.session_object);
         } else {
-          return done(null, { role_id: 100 });
+          return done(null, false);
         }
       };
       if (

package/auth/admin.js

@@ -26,6 +26,7 @@ const {
   error_catcher,
   addOnDoneRedirect,
   is_relative_url,
+  isAdminOrHasConfigMinRole,
 } = require("../routes/utils");
 const { send_reset_email } = require("./resetpw");
 const { getState } = require("@saltcorn/data/db/state");
@@ -136,7 +137,9 @@ const userForm = async (req, user) => {
     type: "Key",
     reftable_name: "roles",
   });
-  const roles = (await User.get_roles()).filter((r) => r.role !== "public");
+  const roles = (await User.get_roles()).filter(
+    (r) => r.role !== "public" && r.id >= req.user.role_id
+  );
   roleField.options = roles.map((r) => ({ label: r.role, value: r.id }));
   const can_reset = getState().getConfig("smtp_host", "") !== "";
   const userFields = (await getUserFields(req)).filter(
@@ -201,11 +204,15 @@ const user_dropdown = (user, req, can_reset) =>
       },
       '<i class="fas fa-edit"></i>&nbsp;' + req.__("Edit")
     ),
-    post_dropdown_item(
-      `/useradmin/become-user/${user.id}`,
-      '<i class="fas fa-ghost"></i>&nbsp;' + req.__("Become user"),
-      req
-    ),
+    ...(req.user.role_id === 1
+      ? [
+          post_dropdown_item(
+            `/useradmin/become-user/${user.id}`,
+            '<i class="fas fa-ghost"></i>&nbsp;' + req.__("Become user"),
+            req
+          ),
+        ]
+      : []),
     post_dropdown_item(
       `/useradmin/set-random-password/${user.id}`,
       '<i class="fas fa-random"></i>&nbsp;' + req.__("Set random password"),
@@ -264,7 +271,7 @@ const user_dropdown = (user, req, can_reset) =>
  */
 router.get(
   "/",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
   error_catcher(async (req, res) => {
     const auth_methods = getState().auth_methods;
     const userBadges = (user) =>
@@ -282,7 +289,10 @@ router.get(
             span({ class: "badge bg-secondary me-1" }, v.label || k)
           )
       );
-    const users = await User.find({}, { orderBy: "id" });
+    const users = await User.find(
+      { role_id: { gt: req.user.role_id, equal: true } },
+      { orderBy: "id" }
+    );
     const roles = await User.get_roles();
     let roleMap = {};
     roles.forEach((r) => {
@@ -344,7 +354,8 @@ router.get(
  */
 router.get(
   "/new",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const form = await userForm(req);
     send_users_page({
@@ -459,6 +470,7 @@ const permissions_settings_form = async (req) =>
       "min_role_edit_files",
       "min_role_edit_search",
       "min_role_create_snapshots",
+      "min_role_edit_users",
       //hidden            "exttables_min_role_read",
     ],
     action: "/useradmin/permissions",
@@ -967,10 +979,16 @@ router.get(
  */
 router.get(
   "/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const user = await User.findOne({ id });
+    if (user.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     const form = await userForm(req, user);
 
     send_users_page({
@@ -1117,7 +1135,8 @@ router.get(
  */
 router.post(
   "/save",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     let form, sub2;
     if ((req.body || {}).id) {
@@ -1153,6 +1172,11 @@ router.post(
       _csrf,
       ...rest
     } = form.values;
+    if (role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     if (id) {
       try {
         const u = await User.findOne({ id });
@@ -1201,10 +1225,16 @@ router.post(
  */
 router.post(
   "/reset-password/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await send_reset_email(u, req, { from_admin: true });
     req.flash("success", req.__(`Reset password link sent to %s`, u.email));
 
@@ -1220,11 +1250,17 @@ router.post(
  */
 router.post(
   "/send-verification/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
     // todo add test case
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     const result = await send_verification_email(u, req);
     if (result.error)
       req.flash(
@@ -1249,10 +1285,16 @@ router.post(
  */
 router.post(
   "/gen-api-token/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.getNewAPIToken();
     req.flash("success", req.__(`New API token generated`));
 
@@ -1268,10 +1310,16 @@ router.post(
  */
 router.post(
   "/remove-api-token/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.removeAPIToken();
     req.flash("success", req.__(`API token removed`));
 
@@ -1287,10 +1335,16 @@ router.post(
  */
 router.post(
   "/revoke-api-token/:uid/:tokenId",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { uid, tokenId } = req.params;
     const u = await User.findOne({ id: uid });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.revokeApiToken(+tokenId);
     req.flash("success", req.__(`API token revoked`));
     res.redirect(getOnDoneRedirect(req, `/useradmin/${u.id}`));
@@ -1302,10 +1356,16 @@ router.post(
  */
 router.post(
   "/revoke-original-api-token/:uid",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { uid } = req.params;
     const u = await User.findOne({ id: uid });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.revokeOriginalApiToken();
     req.flash("success", req.__(`API token revoked`));
     res.redirect(getOnDoneRedirect(req, `/useradmin/${u.id}`));
@@ -1320,10 +1380,16 @@ router.post(
  */
 router.post(
   "/set-random-password/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
+
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     const newpw = User.generate_password();
     await u.changePasswordTo(newpw);
     await u.destroy_sessions();
@@ -1372,10 +1438,15 @@ router.post(
  */
 router.post(
   "/disable/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.update({ disabled: true });
     await u.destroy_sessions();
     req.flash("success", req.__(`Disabled user %s`, u.email));
@@ -1390,10 +1461,15 @@ router.post(
  */
 router.post(
   "/force-logout/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.destroy_sessions();
     req.flash("success", req.__(`Logged out user %s`, u.email));
     res.redirect(getOnDoneRedirect(req));
@@ -1407,10 +1483,15 @@ router.post(
  */
 router.post(
   "/enable/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.update({ disabled: false });
     req.flash("success", req.__(`Enabled user %s`, u.email));
     res.redirect(getOnDoneRedirect(req));
@@ -1424,10 +1505,15 @@ router.post(
  */
 router.post(
   "/delete/:id",
-  isAdmin,
+  isAdminOrHasConfigMinRole("min_role_edit_users"),
   error_catcher(async (req, res) => {
     const { id } = req.params;
     const u = await User.findOne({ id });
+    if (u.role_id < req.user.role_id) {
+      req.flash("error", req.__(`Not authorized`));
+      res.redirect("/useradmin");
+      return;
+    }
     await u.delete();
     req.flash("success", req.__(`User %s deleted`, u.email));
 

package/auth/routes.js

@@ -286,6 +286,7 @@ const loginWithJwt = async (email, password, saltcornApp, res, req) => {
             iss: "saltcorn@saltcorn",
             aud: "saltcorn-mobile-app",
             iat: now.valueOf(),
+            exp: Math.floor(now.valueOf() / 1000) + 30 * 24 * 3600,
             tenant: db.getTenantSchema(),
           },
           jwt_secret
@@ -1414,6 +1415,69 @@ router.get(
   })
 );
 
+/**
+ * @name post/login-with/jwt
+ * @function
+ * @memberof module:auth/routes~routesRouter
+ */
+router.post(
+  "/login-with/jwt",
+  error_catcher(async (req, res) => {
+    const { email, password } = req.body;
+    await loginWithJwt(
+      email,
+      password,
+      req.headers["x-saltcorn-app"],
+      res,
+      req
+    );
+  })
+);
+
+/**
+ * @name post/renew-jwt
+ * @function
+ * @memberof module:auth/routes~routesRouter
+ */
+router.post(
+  "/renew-jwt",
+  passport.authenticate("jwt", { session: false }),
+  error_catcher(async (req, res) => {
+    if (!req.user?.email) {
+      return res.status(401).json({ error: req.__("Not authenticated") });
+    }
+    const renewFn = async () => {
+      const user = await User.findOne({ email: req.user.email });
+      if (!user)
+        return res.status(401).json({ error: req.__("User not found") });
+      const now = new Date();
+      const pushEnabled = !!user._attributes?.notify_push;
+      const tokenUser = { ...user.session_object };
+      if (tokenUser.attributes) tokenUser.attributes.notify_push = pushEnabled;
+      else tokenUser._attributes = { notify_push: pushEnabled };
+      const token = jwt.sign(
+        {
+          sub: user.email,
+          user: tokenUser,
+          iss: "saltcorn@saltcorn",
+          aud: "saltcorn-mobile-app",
+          iat: now.valueOf(),
+          exp: Math.floor(now.valueOf() / 1000) + 30 * 24 * 3600,
+          tenant: db.getTenantSchema(),
+        },
+        db.connectObj.jwt_secret
+      );
+      res.json(token);
+    };
+    const saltcornApp = req.headers["x-saltcorn-app"];
+    if (saltcornApp && saltcornApp !== db.connectObj.default_schema) {
+      await db.runWithTenant(saltcornApp, renewFn);
+    } else {
+      await renewFn();
+    }
+  })
+);
+
 /*
   returns if 'req.user' is an authenticated user
  */
@@ -1519,7 +1583,10 @@ const loginCallback = (req, res, method) => async () => {
       const user = await User.findOne({ email: req.user.email });
       if (!user.last_mobile_login) await user.updateLastMobileLogin(now);
       res.redirect(
-        `mobileapp://auth/callback?token=${await generateTokenForUser(req.user, now)}&method=${encodeURIComponent(method)}`
+        `mobileapp://auth/callback?token=${await generateTokenForUser(
+          req.user,
+          now
+        )}&method=${encodeURIComponent(method)}`
       );
     } else res.redirect("/");
   }

package/auth/testhelp.js

@@ -185,13 +185,9 @@ const getAdminJwt = async () => {
     "X-Saltcorn-Client": "mobile-app",
   };
   const res = await request(app)
-    .get(
-      `/auth/login-with/jwt?email=${encodeURIComponent(
-        "admin@foo.com"
-      )}&password=${encodeURIComponent("AhGGr6rhu45")}`
-    )
-
-    .set(headers);
+    .post("/auth/login-with/jwt")
+    .set(headers)
+    .send({ email: "admin@foo.com", password: "AhGGr6rhu45" });
   if (res.statusCode !== 200) console.log(res.text);
   return res.body;
 };
@@ -203,12 +199,9 @@ const getStaffJwt = async () => {
     "X-Saltcorn-Client": "mobile-app",
   };
   const res = await request(app)
-    .get(
-      `/auth/login-with/jwt?email${encodeURIComponent(
-        "staff@foo.com"
-      )}&password=${encodeURIComponent("ghrarhr54hg")}`
-    )
-    .set(headers);
+    .post("/auth/login-with/jwt")
+    .set(headers)
+    .send({ email: "staff@foo.com", password: "ghrarhr54hg" });
   if (res.statusCode !== 200) console.log(res.text);
   return res.body;
 };
@@ -220,12 +213,9 @@ const getUserJwt = async () => {
     "X-Saltcorn-Client": "mobile-app",
   };
   const res = await request(app)
-    .get(
-      `/auth/login-with/jwt?email=${encodeURIComponent(
-        "user@foo.com"
-      )}&password=${encodeURIComponent("GFeggwrwq45fjn")}`
-    )
-    .set(headers);
+    .post("/auth/login-with/jwt")
+    .set(headers)
+    .send({ email: "user@foo.com", password: "GFeggwrwq45fjn" });
   if (res.statusCode !== 200) console.log(res.text);
   return res.body;
 };

package/docs/assets/hierarchy.js

@@ -1 +1 @@
-window.hierarchyData = "eJy1l11vmzAYhf+LrynDNmDD3aR9XG2aqmq7qCrkBoei8hEZsqqq+t8nG5MYQglO2I2FjHTOY8t+fd43IOq6bUB8j6CPPAdBHxMHwcDz5UgDB8EQypkQR3IMoRwj6iBIPDlDAjlDQiRHIucpViOFDsY0CB4cIPi24Js2r6sGxG9AWcmPipUcxODzY9MKtmm/5bxIgQOe8yoFMQpCB+xFAWKQVy0XW7bhzaekYUW7qUWVtK873rhlnfLihmmFJum/kq0UcwfS7lNbFsABm4I1DYhB26Q30uvmoC9/PuVFKngF4nvsExw+vDtA7cpHwLd8x1n7H7E7A3v4yIs6+MDzp+BrUa5GXYvSNYWtaQOIkaalwQTtL5bxtWh3LOOuKWxNG3rQ72hDOHUwpOh3Ue93ayInmVR0TzwuoCd6r0MczdH/4OUjF+uvISmV8OlSOkP7BUFM9YJCOLWgYp/l1WrrUGruUPwCZtIzR3SC+bYuVjvwoi6OB14K29OiUBcT4k0dmTv2uB5uK8XcgbQ9MIa6dJNg6kjcsWw93MyAzexRid+jhmga9WvVitcVeRMuBd2xgz067d8YQqYO8Z3Is2y9CtJ2cu5I/gJsXxdAiqewf+f8ZS3mvzl/cU1ha1oCIdG0dOoo/6nF87aoVyN+0Xru2MCeHFFV4zCm2HzUv+zL8vVnnR4rBkS0R1bqA96UtcxNc5YJViZVnfImSaWC+nYPYh/idRMdR2ByXIWgzBf4DrdE7oTMxdRzMI48JEfky9EnequomY3l03gVpnp1FWsvtWSfIs+sRKoEX0WhSnqHcRBbxIHM6Krv+3UknYZmOQouovHNsCcv81UosjR0HL3UAgjZkxgQw57pPIG69Y1uM+a7IsMzGjz6U22PnbPoWpol7c2RQrYIJoXZvyy3l83JbIdyNJQpf3QV7Q1VszHbZJiGBI0Mh12ElavuF873CQYAHLyHHzUCF2D0kX9p1DeZBtFilOWXo3Qx/UxaN2xRaJ75QRxfbKqC92zgNgwxDMc1196xy87zmdnwJP7QM7vEMXPnYq/hRgdl5CTX2ljqBHs2uZruPjp9Sy4w16HzXPg8OssAN3o37G1VjpzNj4YhouaVOQmIi00PUfBsBNTm7+//AFCV5z0="
+window.hierarchyData = "eJy1l11vmzAYhf+Lr6mHbcAmd5P2cbVpqqrtoqqQGxyKykdkyKqq6n+fbJzEEEpwwm4sZKRzHlv26/O+AVnXbQNW9xgFGHkYBYR5GIV+qEYWeRhFSM1Ega/GCKsxjj2MKFIzNFQzNCJqpGqeET0y7BHCwujBA1JsCrFu87pqwOoNaCv1UfFSgBX4/Ni0kq/bb7koUuCB57xKwQqHkQd2sgArkFetkBu+Fs2npOFFu65llbSvW9HAsk5FccONQpPsv5KNEoM9afjUlgXwwLrgTQNWoG3SG+V1c9BXP5/yIpWiAqt7ElBCH949oHflI+BbsRW8/Y/YnYE7fIz8Dj70wzH4WpaLUdeyhLawM22ICDG0LBqh/cUzsRTtlmcC2sLOtJGPwo42QmMHQ4l+l/VuuyRykilFeOJxAT01ex0F/hT9D1E+Crn8GpJSC58upTN0XxAisVlQhMcWVOyyvFpsHVoN9sUvYKZ75jgeYb6ti8UOvKyL44FXwu60mJpiQtHYkbnjj8vhtkoM9qTdgQkypZuGY0fijmfL4WYWbOaOSgNmUCMyjvq1auXrgryJUIJw6OCOzhAy6HTsEN/JPMuWqyBtJwcH8hdgB0GHzcgY9u9cvCzF/DcXL9AWdqalCJlKwdjYUf5Ty+dNUS9G/GL04NDAnRzHumoQwoj9qH/ZleXrzzo9VgyE2R5Zq/d4U95ymOY8k7xMqjoVTZIqBf0ND2If4nUTHUdoc1yFoM1n+Pa3RO2EysUMeYTEPlEjDtXYFQH9y0JUT+NVmPrV1ax7qTn7FPt2JdIl+CoKXdI7jIPYLA5sR1dz368j6TQMy1FwFk1ghz11ma9CUaWh49hLzYBQPYkF0e+ZzhPoW9+YNmO6K7I8496jP9b2uDnLrqWZ094cKVSLYFPY/ct8e9WcTHYoR0OV8gdX0d1QNxuTTYZtSMnAsN9FOLmafuF8n2ABoN57+FEjcAHGPvLPjfo2Uy9aDLL8fJQupp9J65YtpvaZ78Xx2aY6eE8GbsuQIDqsue6OXXaezsyWJ+1VNDsUOzhmcCr2Wm4Mob5bP9e6WJoEeza52u5BcPqWXGBuQue58Hl0VgFu8G642+ocOZkfLUMc22f3JCDONj1EwbMR0Ji/v/8DHhnnHw=="