@saltcorn/server 1.6.0-beta.3 → 1.6.0-beta.5

package/routes/actions.js

@@ -75,6 +75,8 @@ const {
   h4,
   p,
   style,
+  h5,
+  textarea,
 } = require("@saltcorn/markup/tags");
 const Table = require("@saltcorn/data/models/table");
 const { getActionConfigFields } = require("@saltcorn/data/plugin-helper");
@@ -439,9 +441,14 @@ const triggerForm = async (req, trigger) => {
         label: req.__("Only if"),
         type: "String",
         class: "validate-expression",
-        sublabel: req.__(
-          "Optional JavaScript expression to determine if the trigger should run."
-        ),
+        sublabel:
+          req.__(
+            "Optional JavaScript expression to determine if the trigger should run."
+          ) +
+          " " +
+          req.__(
+            "On updates, use <code>row.old_row</code> to access values before the update."
+          ),
         parent_field: "configuration",
         showIf: {
           when_trigger: [...table_triggers, ...additional_triggers_with_onlyif],
@@ -1352,6 +1359,146 @@ router.get(
       });
       // populate form values
       form.values = trigger.configuration;
+
+      const hasCopilot =
+        trigger.action === "run_js_code" &&
+        !!getState().functions.copilot_generate_javascript;
+
+      if (hasCopilot) {
+        form.additionalButtons = [
+          {
+            label: req.__("Edit with AI"),
+            onclick: "showJsCopilotModal(this)",
+            class: "btn btn-secondary",
+          },
+        ];
+      }
+
+      const copilotModal = hasCopilot
+        ? div(
+            {
+              class: "modal fade",
+              id: "jsCopilotModal",
+              tabindex: "-1",
+            },
+            div(
+              { class: "modal-dialog" },
+              div(
+                { class: "modal-content" },
+                div(
+                  { class: "modal-header" },
+                  h5({ class: "modal-title" }, req.__("Edit with AI")),
+                  button({
+                    type: "button",
+                    class: "btn-close",
+                    "data-bs-dismiss": "modal",
+                  })
+                ),
+                div(
+                  { class: "modal-body" },
+                  p(
+                    { class: "text-muted small" },
+                    req.__(
+                      "Describe what the code should do. The existing code will be used as context."
+                    )
+                  ),
+                  textarea({
+                    id: "jsCopilotPrompt",
+                    class: "form-control",
+                    rows: 3,
+                    placeholder: req.__("Enter your prompt..."),
+                  }),
+                  div({
+                    id: "jsCopilotError",
+                    class: "alert alert-danger mt-2 mb-0 d-none",
+                  })
+                ),
+                div(
+                  { class: "modal-footer" },
+                  button(
+                    { class: "btn btn-secondary", "data-bs-dismiss": "modal" },
+                    req.__("Cancel")
+                  ),
+                  button(
+                    {
+                      id: "jsCopilotGenBtn",
+                      class: "btn btn-primary",
+                      onclick: "runJsCopilot()",
+                      disabled: true,
+                    },
+                    req.__("Generate")
+                  )
+                )
+              )
+            )
+          ) +
+          script(`
+function showJsCopilotModal() {
+  var modal = new bootstrap.Modal(document.getElementById("jsCopilotModal"));
+  modal.show();
+}
+document.addEventListener("DOMContentLoaded", function () {
+  var ta = document.getElementById("jsCopilotPrompt");
+  var btn = document.getElementById("jsCopilotGenBtn");
+  if (ta && btn) {
+    ta.addEventListener("input", function () {
+      btn.disabled = !ta.value.trim();
+    });
+  }
+});
+function runJsCopilot() {
+  var ta = document.getElementById("jsCopilotPrompt");
+  var prompt = ta.value.trim();
+  if (!prompt) return;
+  var btn = document.getElementById("jsCopilotGenBtn");
+  var errDiv = document.getElementById("jsCopilotError");
+  btn.disabled = true;
+  btn.textContent = ${JSON.stringify(req.__("Generating..."))};
+  errDiv.classList.add("d-none");
+  fetch("/actions/gen-js-copilot/${id}", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-Requested-With": "XMLHttpRequest",
+      "CSRF-Token": _sc_globalCsrf,
+    },
+    body: JSON.stringify({ description: prompt }),
+  })
+    .then(function (r) {
+      return r.json();
+    })
+    .then(function (data) {
+      btn.textContent = ${JSON.stringify(req.__("Generate"))};
+      if (data.error) {
+        btn.disabled = !ta.value.trim();
+        errDiv.textContent = data.error;
+        errDiv.classList.remove("d-none");
+        return;
+      }
+      ta.value = "";
+      btn.disabled = true;
+      var editorDiv = document.querySelector('textarea[name="code"]');
+      if (editorDiv) {
+        var monacoDiv = editorDiv.nextElementSibling;
+        if (monacoDiv) {
+          var ed = $(monacoDiv).data("monaco-editor");
+          if (ed) ed.setValue(data.code);
+        }
+      }
+      bootstrap.Modal.getInstance(
+        document.getElementById("jsCopilotModal")
+      ).hide();
+    })
+    .catch(function (err) {
+      btn.disabled = !ta.value.trim();
+      btn.textContent = ${JSON.stringify(req.__("Generate"))};
+      errDiv.textContent = err.message || "Request failed";
+      errDiv.classList.remove("d-none");
+    });
+}
+          `)
+        : "";
+
       // send events page
       send_events_page({
         res,
@@ -1367,7 +1514,7 @@ router.get(
             span({ class: "copy-to-clipboard" }, trigger.name)
           ),
           subtitle,
-          contents: renderForm(form, req.csrfToken()),
+          contents: copilotModal + renderForm(form, req.csrfToken()),
         },
       });
     }
@@ -1935,6 +2082,45 @@ router.post(
   })
 );
 
+router.post(
+  "/gen-js-copilot/:id",
+  isAdminOrHasConfigMinRole("min_role_edit_triggers"),
+  error_catcher(async (req, res) => {
+    const { id } = req.params;
+    const trigger = await Trigger.findOne({ id });
+    if (!trigger) {
+      req.flash("warning", req.__("Action not found"));
+      res.redirect(`/actions/`);
+      return;
+    }
+    const description = (req.body || {}).description;
+    // await Trigger.update(trigger.id, { description });
+    const table = trigger.table_id
+      ? Table.findOne({ id: trigger.table_id })
+      : null;
+    const existing_code = trigger.configuration?.code || "";
+    const generated =
+      await getState().functions.copilot_generate_javascript.run(
+        description,
+        existing_code,
+        table?.name || null
+      );
+    await Trigger.update(trigger.id, {
+      configuration: { ...trigger.configuration, code: generated },
+    });
+    await getState().refresh_triggers();
+    Trigger.emitEvent("AppChange", `Trigger ${trigger.name}`, req.user, {
+      entity_type: "Trigger",
+      entity_name: trigger.name,
+    });
+    if (req.xhr) {
+      res.json({ code: generated });
+    } else {
+      res.redirect(`/actions/configure/${trigger.id}`);
+    }
+  })
+);
+
 router.post(
   "/gen-copilot/:trigger_id",
   isAdminOrHasConfigMinRole("min_role_edit_triggers"),

package/routes/admin.js

@@ -76,7 +76,6 @@ const {
   //get_other_domain_tenant,
   get_process_init_time,
 } = require("@saltcorn/data/db/state");
-const { loadAllPlugins } = require("../load_plugins");
 const {
   create_backup,
   restore,
@@ -88,7 +87,6 @@ const {
   runConfigurationCheck,
 } = require("@saltcorn/admin-models/models/config-check");
 const fs = require("fs");
-const load_plugins = require("../load_plugins");
 const {
   restore_backup,
   send_admin_page,
@@ -1008,7 +1006,7 @@ router.post(
         const pack = JSON.parse(fs.readFileSync(req.files?.file?.tempFilePath));
         await db.withTransaction(async () => {
           await install_pack(pack, undefined, (p) =>
-            load_plugins.loadAndSaveNewPlugin(p)
+            Plugin.loadAndSaveNewPlugin(p)
           );
         });
         await getState().refresh();
@@ -1648,7 +1646,7 @@ router.post(
       if (process.send) getState().processSend("RestartServer");
       else process.exit(0);
     } else {
-      await restart_tenant(loadAllPlugins);
+      await restart_tenant(Plugin.loadAllPlugins);
       getState().processSend({
         restart_tenant: true,
         tenant: db.getTenantSchema(),
@@ -2030,7 +2028,7 @@ router.post(
     const newPath = File.get_new_path();
     await req.files.file.mv(newPath);
     const err = await restore(newPath, (p) =>
-      load_plugins.loadAndSaveNewPlugin(p)
+      Plugin.loadAndSaveNewPlugin(p)
     );
     if (err) req.flash("error", err);
     else req.flash("success", req.__("Successfully restored backup"));

package/routes/api.js

@@ -68,13 +68,13 @@ const limitFields = (fields) => (r) => {
 };
 
 /**
- * Check that user has right to read table data (only read in terms of CRUD)
+ * Check that user potentially has right to read table data (only read in terms of CRUD). In case of ownership fields/formula, further checks are needed.
  * @param {object} req httprequest
  * @param {object} user - user based on access token
  * @param {Table} table
  * @returns {boolean}
  */
-function accessAllowedRead(req, user, table, allow_ownership) {
+function potentiallyAccessAllowedRead(req, user, table, allow_ownership) {
   const role =
     req.user && req.user.id
       ? req.user.role_id
@@ -91,13 +91,13 @@ function accessAllowedRead(req, user, table, allow_ownership) {
 }
 
 /**
- * Check that user has right to write table data (create, update, delete in terms of  CRUD)
+ * Check that user potentially has right to write table data (create, update, delete in terms of  CRUD). In case of ownership fields/formula, further checks are needed.
  * @param {object} req httprequest
  * @param {object} user user based on access token
  * @param {Table} table
  * @returns {boolean}
  */
-function accessAllowedWrite(req, user, table) {
+function potentiallyAccessAllowedWrite(req, user, table) {
   const role =
     req.user && req.user.id
       ? req.user.role_id
@@ -278,7 +278,8 @@ router.post(
             folder ? File.normalise(folder) : undefined
           );
           const many = Array.isArray(f);
-          const formatLocation = (fl) => File.fieldValueFromRelative(fl.path_to_serve);
+          const formatLocation = (fl) =>
+            File.fieldValueFromRelative(fl.path_to_serve);
           const formatUrl = (loc, filename) =>
             File.pathToServeUrl(loc, { filename });
           jsonResp = {
@@ -288,9 +289,7 @@ router.post(
                 ? f.map((fl) => formatLocation(fl))
                 : formatLocation(f),
               url: many
-                ? f.map((fl) =>
-                    formatUrl(formatLocation(fl), fl.filename)
-                  )
+                ? f.map((fl) => formatUrl(formatLocation(fl), fl.filename))
                 : formatUrl(formatLocation(f), f.filename),
             },
           };
@@ -326,7 +325,8 @@ router.get(
       "api-bearer",
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedRead(req, user, table)) {
+        if (potentiallyAccessAllowedRead(req, user, table)) {
+          const myReq = { user: user || req.user, __: req.__ };
           const field = table.getFields().find((f) => f.name === fieldName);
           if (!field) {
             res.status(404).json({ error: req.__("Not found") });
@@ -337,9 +337,9 @@ router.get(
             field.is_fkey ||
             (field.type.name === "String" && field.attributes?.options)
           ) {
-            dvs = await field.distinct_values();
+            dvs = await field.distinct_values(myReq);
           } else {
-            dvs = await table.distinctValues(fieldName);
+            dvs = await table.distinctValues(fieldName, {}, user || req.user);
           }
           res.json({ success: dvs });
         } else {
@@ -442,7 +442,7 @@ router.get(
       ["api-bearer", "jwt"],
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedRead(req, user, table, true)) {
+        if (potentiallyAccessAllowedRead(req, user, table, true)) {
           let rows;
           if (versioncount === "on") {
             const joinOpts = {
@@ -472,6 +472,7 @@ router.get(
               state: req_query,
               table,
               prefix: "a.",
+              user: req.user || user,
             });
             const joinFields = {};
             const derefs = Array.isArray(dereference)
@@ -544,7 +545,7 @@ router.get("/:tableName/count", async (req, res, next) => {
     ["api-bearer", "jwt"],
     { session: false },
     async function (err, user, info) {
-      if (accessAllowedRead(req, user, table)) {
+      if (potentiallyAccessAllowedRead(req, user, table)) {
         const tbl_fields = table.getFields();
         readState(req_query, tbl_fields, req);
         const qstate = stateFieldsToWhere({
@@ -553,6 +554,7 @@ router.get("/:tableName/count", async (req, res, next) => {
           state: req_query,
           table,
           prefix: "a.",
+          user: req.user || user
         });
         const count = await table.countRows(qstate);
         res.json({ success: count });
@@ -568,8 +570,10 @@ router.get("/:tableName/count", async (req, res, next) => {
  * Emit Event using POST
  * This is used from the mobile app to send an event to the server.
  *
- * The user comes the JWT token and actions,
- * listening for the event, have to check on their own if the user is allowed to run it.
+ * Authenticated users may only emit events listed in the
+ * `mobile_emit_allowed_events` config.
+ * Public users (role_id=100, no id) may only emit events listed in the
+ * `mobile_emit_public_events` config (default: empty — disabled).
  */
 router.post(
   "/emit-event/:eventname",
@@ -578,15 +582,44 @@ router.post(
       "jwt",
       { session: false },
       async function (err, user, info) {
-        if (user) {
-          const { eventname } = req.params;
-          const { channel, payload } = req.body;
-          Trigger.emitEvent(eventname, channel, user, payload);
-          res.json({ success: true });
-        } else {
+        if (!user) {
           getState().log(3, `API POST emit-event not authorized`);
-          res.status(401).json({ error: req.__("Not authorized") });
+          return res.status(401).json({ error: req.__("Not authorized") });
+        }
+        const { eventname } = req.params;
+        const { channel, payload } = req.body;
+        const state = getState();
+        if (!user.id) {
+          // public user — only allowed if explicitly configured
+          const publicAllowed = state.getConfig(
+            "mobile_emit_public_events",
+            []
+          );
+          if (!publicAllowed.includes(eventname)) {
+            state.log(3, `API POST emit-event not authorized for public user`);
+            return res.status(401).json({ error: req.__("Not authorized") });
+          }
+        } else {
+          // authenticated user — ReceiveMobileShareData always allowed, rest requires config
+          const configAllowed = state.getConfig(
+            "mobile_emit_allowed_events",
+            []
+          );
+          if (
+            eventname !== "ReceiveMobileShareData" &&
+            !configAllowed.includes(eventname)
+          ) {
+            state.log(
+              3,
+              `API POST emit-event: event type '${eventname}' not allowed`
+            );
+            return res
+              .status(403)
+              .json({ error: req.__("Event type not allowed") });
+          }
         }
+        Trigger.emitEvent(eventname, channel, user, payload);
+        res.json({ success: true });
       }
     )(req, res, next);
   })
@@ -700,7 +733,7 @@ router.post(
       "api-bearer",
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedWrite(req, user, table)) {
+        if (potentiallyAccessAllowedWrite(req, user, table)) {
           const { _versions, ...row } = req.body || {};
           const fields = table.getFields();
           readState(row, fields, req);
@@ -754,7 +787,7 @@ router.post(
       "api-bearer",
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedWrite(req, user, table)) {
+        if (potentiallyAccessAllowedWrite(req, user, table)) {
           try {
             await db.withTransaction(async () => {
               if (id === "undefined") {
@@ -807,7 +840,7 @@ router.post(
       ["api-bearer", "jwt"],
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedWrite(req, user, table)) {
+        if (potentiallyAccessAllowedWrite(req, user, table)) {
           const { _versions, ...row } = req.body || {};
           const fields = table.getFields();
           readState(row, fields, req);
@@ -862,7 +895,7 @@ router.delete(
       "api-bearer",
       { session: false },
       async function (err, user, info) {
-        if (accessAllowedWrite(req, user, table)) {
+        if (potentiallyAccessAllowedWrite(req, user, table)) {
           try {
             //await db.withTransaction(async () => {
             if (id === "undefined") {

package/routes/delete.js

@@ -6,7 +6,7 @@
 
 const Router = require("express-promise-router");
 
-const { error_catcher, is_relative_url } = require("./utils.js");
+const { error_catcher, is_relative_url, safe_redirect } = require("./utils.js");
 const Table = require("@saltcorn/data/models/table");
 const { readState } = require("@saltcorn/data/plugin-helper");
 const {
@@ -86,10 +86,7 @@ router.post(
     }
     if (req.xhr) {
       res.json({ success, ...resultCollector });
-    } else
-      res.redirect(
-        (is_relative_url(redirect) && redirect) || `/list/${table.name}`
-      );
+    } else safe_redirect(res, redirect, `/list/${table.name}`);
   })
 );
 router.post(

package/routes/edit.js

@@ -6,7 +6,7 @@
 
 const Router = require("express-promise-router");
 
-const { error_catcher, is_relative_url } = require("./utils.js");
+const { error_catcher, is_relative_url, safe_redirect } = require("./utils.js");
 const Table = require("@saltcorn/data/models/table");
 
 /**
@@ -46,9 +46,6 @@ router.post(
 
     if (req.xhr) res.send("OK");
     else if (req.get("referer")) res.redirect(req.get("referer"));
-    else
-      res.redirect(
-        (is_relative_url(redirect) && redirect) || `/list/${table.name}`
-      );
+    else safe_redirect(res, redirect, `/list/${table.name}`);
   })
 );