@saltcorn/server 1.6.0-beta.2 → 1.6.0-beta.4

package/routes/sync.js

@@ -14,6 +14,7 @@ module.exports = router;
 
 router.get(
   "/sync_timestamp",
+  loggedIn,
   error_catcher(async (req, res) => {
     try {
       res.json({ syncTimestamp: (await db.time()).valueOf() });
@@ -116,6 +117,7 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
 */
 router.post(
   "/load_changes",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { syncInfos, loadUntil } = req.body || {};
     if (!loadUntil) {
@@ -193,6 +195,7 @@ const getDelRows = async (tblName, syncFrom, syncUntil) => {
 */
 router.post(
   "/deletes",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { syncInfos, syncTimestamp } = req.body || {};
     try {
@@ -225,17 +228,19 @@ router.post(
 */
 router.post(
   "/offline_changes",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { changes, newSyncTimestamp, oldSyncTimestamp } = req.body || {};
     const rootFolder = await File.rootFolder();
     try {
       const syncDirName = `${newSyncTimestamp}_${req.user?.email || "public"}`;
-      const syncDir = path.join(
-        rootFolder.location,
-        "mobile_app",
-        "sync",
+      const syncDir = File.normalise_in_base(
+        path.join(rootFolder.location, "mobile_app", "sync"),
         syncDirName
       );
+      if (!syncDir) {
+        return res.status(400).json({ error: "Invalid sync directory name" });
+      }
       await fs.mkdir(syncDir, { recursive: true });
       await fs.writeFile(
         path.join(syncDir, "changes.json"),
@@ -287,16 +292,22 @@ const readOutFile = async (entries, syncDir, fileName) => {
 
 router.get(
   "/upload_finished",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { dir_name } = req.query;
     try {
+      const expectedSuffix = `_${req.user?.email || "public"}`;
+      if (!dir_name || !dir_name.endsWith(expectedSuffix)) {
+        return res.status(403).json({ error: "Access denied" });
+      }
       const rootFolder = await File.rootFolder();
-      const syncDir = path.join(
-        rootFolder.location,
-        "mobile_app",
-        "sync",
+      const syncDir = File.normalise_in_base(
+        path.join(rootFolder.location, "mobile_app", "sync"),
         dir_name
       );
+      if (!syncDir) {
+        return res.json({ finished: false });
+      }
       let entries = null;
       try {
         entries = await fs.readdir(syncDir);
@@ -340,9 +351,14 @@ router.get(
 
 router.post(
   "/clean_sync_dir",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { dir_name } = req.body || {};
     try {
+      const expectedSuffix = `_${req.user?.email || "public"}`;
+      if (!dir_name || !dir_name.endsWith(expectedSuffix)) {
+        return res.status(403).json({ error: "Access denied" });
+      }
       const rootFolder = await File.rootFolder();
       const syncDir = File.normalise_in_base(
         path.join(rootFolder.location, "mobile_app", "sync"),

package/routes/viewedit.js

@@ -1019,7 +1019,7 @@ router.post(
   "/copilot-generate-layout",
   isAdminOrHasConfigMinRole(["min_role_edit_views", "min_role_edit_pages"]),
   error_catcher(async (req, res) => {
-    const { mode, table, prompt } = req.body;
+    const { mode, table, prompt, existing } = req.body;
     const f = getState().functions.copilot_generate_layout;
     if (!f) {
       res.json({
@@ -1027,7 +1027,7 @@ router.post(
       });
       return;
     }
-    const layout = await f.run(prompt, mode, table);
+    const layout = await f.run(prompt, mode, table, existing);
     res.json({ success: "ok", layout });
   })
 );

package/tests/api.test.js

@@ -760,7 +760,7 @@ describe("API emit", () => {
     const app = await getApp({ disableCsrf: true });
     const token = await getAdminJwt();
     await request(app)
-      .post("/api/emit-event/event1")
+      .post("/api/emit-event/ReceiveMobileShareData")
       .set("Authorization", `jwt ${token}`)
       .send({ payload: { latitude: 20, longitude: 30 } })
       .expect(succeedJsonWith((success) => success === true));
@@ -770,12 +770,134 @@ describe("API emit", () => {
   it("denies an event without JWT", async () => {
     const app = await getApp({ disableCsrf: true });
     await request(app)
-      .post("/api/emit-event/event1")
+      .post("/api/emit-event/ReceiveMobileShareData")
       .send({ payload: { latitude: 20, longitude: 30 } })
       .expect(notAuthorized);
   });
 });
 
+describe("API emit-event access control", () => {
+  const getPublicJwt = async () => {
+    const app = await getApp({ disableCsrf: true });
+    const res = await request(app)
+      .post("/auth/login-with/jwt")
+      .set("X-Requested-With", "XMLHttpRequest")
+      .set("X-Saltcorn-Client", "mobile-app")
+      .send({});
+    return res.body;
+  };
+
+  let adminJwt;
+  beforeAll(async () => {
+    adminJwt = await getAdminJwt();
+  });
+
+  afterEach(async () => {
+    await getState().setConfig("mobile_emit_allowed_events", []);
+    await getState().setConfig("mobile_emit_public_events", []);
+  });
+
+  // --- authenticated user ---
+
+  it("allows authenticated user to emit ReceiveMobileShareData by default", async () => {
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/ReceiveMobileShareData")
+      .set("Authorization", `jwt ${adminJwt}`)
+      .send({ payload: {} })
+      .expect(succeedJsonWith((success) => success === true));
+  });
+
+  it("blocks authenticated user from emitting other events by default", async () => {
+    const app = await getApp({ disableCsrf: true });
+    for (const eventName of [
+      "AppChange",
+      "Login",
+      "Error",
+      "Startup",
+      "UserVerified",
+    ]) {
+      await request(app)
+        .post(`/api/emit-event/${eventName}`)
+        .set("Authorization", `jwt ${adminJwt}`)
+        .send({ payload: {} })
+        .expect(
+          respondJsonWith(403, (resp) => resp.error === "Event type not allowed")
+        );
+    }
+  });
+
+  it("allows authenticated user to emit event listed in mobile_emit_allowed_events config", async () => {
+    await getState().setConfig("mobile_emit_allowed_events", ["AppChange"]);
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/AppChange")
+      .set("Authorization", `jwt ${adminJwt}`)
+      .send({ payload: {} })
+      .expect(succeedJsonWith((success) => success === true));
+  });
+
+  it("blocks authenticated user from emitting event not listed in mobile_emit_allowed_events config", async () => {
+    await getState().setConfig("mobile_emit_allowed_events", ["AppChange"]);
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/Login")
+      .set("Authorization", `jwt ${adminJwt}`)
+      .send({ payload: {} })
+      .expect(
+        respondJsonWith(403, (resp) => resp.error === "Event type not allowed")
+      );
+  });
+
+  // --- public user ---
+
+  it("blocks public JWT user from emitting any event by default", async () => {
+    const publicJwt = await getPublicJwt();
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/ReceiveMobileShareData")
+      .set("Authorization", `jwt ${publicJwt}`)
+      .send({ payload: {} })
+      .expect(notAuthorized);
+  });
+
+  it("allows public JWT user to emit event listed in mobile_emit_public_events config", async () => {
+    await getState().setConfig("mobile_emit_public_events", [
+      "CustomerEnquiry",
+    ]);
+    const publicJwt = await getPublicJwt();
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/CustomerEnquiry")
+      .set("Authorization", `jwt ${publicJwt}`)
+      .send({ payload: {} })
+      .expect(succeedJsonWith((success) => success === true));
+  });
+
+  it("blocks public JWT user from emitting event not listed in mobile_emit_public_events config", async () => {
+    await getState().setConfig("mobile_emit_public_events", [
+      "CustomerEnquiry",
+    ]);
+    const publicJwt = await getPublicJwt();
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/OtherEvent")
+      .set("Authorization", `jwt ${publicJwt}`)
+      .send({ payload: {} })
+      .expect(notAuthorized);
+  });
+
+  // --- no token ---
+
+  it("blocks request with no JWT at all", async () => {
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/ReceiveMobileShareData")
+      .send({ payload: {} })
+      .expect(notAuthorized);
+  });
+});
+
 describe("test share handler", () => {
   beforeAll(async () => {
     const sharedData = await Table.create("shared_data");

package/tests/files.test.js

@@ -19,6 +19,7 @@ const Field = require("@saltcorn/data/models/field");
 const Table = require("@saltcorn/data/models/table");
 const View = require("@saltcorn/data/models/view");
 const { existsSync } = require("fs");
+const { getState } = require("@saltcorn/data/db/state");
 
 const createTestFile = async (
   folder,
@@ -262,7 +263,7 @@ describe("files admin", () => {
           `/files/edit/${encodeURIComponent("_sc_test_subfolder_one/the-script.js")}`
         )
         .set("Cookie", loginCookie)
-        .expect(toInclude("Not found", 404));
+        .expect(toRedirect("/"));
     });
     it("denies editing a file", async () => {
       const app = await getApp({ disableCsrf: true });
@@ -273,12 +274,7 @@ describe("files admin", () => {
         )
         .set("Cookie", loginCookie)
         .send("value=console.log('I have been edited');")
-        .expect(toRedirect("/files"));
-
-      await request(app)
-        .get("/")
-        .set("Cookie", loginCookie)
-        .expect(toInclude("File not found"));
+        .expect(toRedirect("/"));
     });
 
     it("does not open for folders or not editable extensions", async () => {
@@ -474,6 +470,7 @@ describe("visible_entries test", () => {
   };
 
   it("shows allowed files", async () => {
+    await getState().setConfig("min_role_edit_files", 40)
     await setRole(100, path.join("_sc_test_subfolder_one", "foo_image.png"));
     await setDirRole(100, "_sc_test_subfolder_one");
 

package/tests/sync.test.js

@@ -849,6 +849,64 @@ describe("Upload changes", () => {
     });
 });
 
+describe("sync dir access control", () => {
+  if (!db.isSQLite) {
+    beforeAll(async () => {
+      await initSyncInfo(["books"]);
+    });
+
+    it("upload_finished rejects access to another user's sync dir", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const adminCookie = await getAdminLoginCookie();
+      const userCookie = await getUserLoginCookie();
+
+      const resp = await doUpload(
+        app,
+        adminCookie,
+        new Date().valueOf(),
+        new Date().valueOf(),
+        { books: { inserts: [] } }
+      );
+      expect(resp.status).toBe(200);
+      const { syncDir } = resp._body;
+
+      const pollResp = await request(app)
+        .get(`/sync/upload_finished?dir_name=${encodeURIComponent(syncDir)}`)
+        .set("Cookie", userCookie);
+      expect(pollResp.status).toBe(403);
+
+      await cleanSyncDir(app, adminCookie, syncDir);
+    });
+
+    it("clean_sync_dir rejects deletion of another user's sync dir", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const adminCookie = await getAdminLoginCookie();
+      const userCookie = await getUserLoginCookie();
+
+      const resp = await doUpload(
+        app,
+        adminCookie,
+        new Date().valueOf(),
+        new Date().valueOf(),
+        { books: { inserts: [] } }
+      );
+      expect(resp.status).toBe(200);
+      const { syncDir } = resp._body;
+
+      const deleteResp = await request(app)
+        .post("/sync/clean_sync_dir")
+        .send({ dir_name: syncDir })
+        .set("Cookie", userCookie);
+      expect(deleteResp.status).toBe(403);
+
+      await cleanSyncDir(app, adminCookie, syncDir);
+    });
+  } else
+    it("only pq support", () => {
+      expect(true).toBe(true);
+    });
+});
+
 describe("field level conflicts", () => {
   if (!db.isSQLite) {
     beforeAll(async () => {