@saltcorn/server 1.6.0-beta.3 → 1.6.0-beta.5

package/routes/eventlog.js

@@ -151,6 +151,30 @@ const logSettingsForm = async (req) => {
         showIf: { [w]: true },
       });
   }
+  fields.push(
+    {
+      input_type: "section_header",
+      label: req.__("Mobile app event permissions"),
+    },
+    {
+      name: "mobile_emit_allowed_events",
+      label: req.__("Authenticated user allowed events"),
+      type: "String",
+      sublabel: req.__(
+        "Comma-separated additional event names that authenticated mobile app users may emit. " +
+          "ReceiveMobileShareData is always allowed."
+      ),
+    },
+    {
+      name: "mobile_emit_public_events",
+      label: req.__("Public user allowed events"),
+      type: "String",
+      sublabel: req.__(
+        "Comma-separated event names that unauthenticated (public) mobile app users may emit. " +
+          "Empty means public users cannot emit any events."
+      ),
+    }
+  );
   return new Form({
     action: "/eventlog/settings",
     noSubmitButton: true,
@@ -188,6 +212,13 @@ router.get(
       let cfgk = `delete_${k}_workflows_days`;
       form.values[cfgk] = getState().getConfig(cfgk);
     });
+    for (const k of [
+      "mobile_emit_allowed_events",
+      "mobile_emit_public_events",
+    ]) {
+      const arr = getState().getConfig(k, []);
+      form.values[k] = Array.isArray(arr) ? arr.join(", ") : arr;
+    }
 
     send_events_page({
       res,
@@ -407,6 +438,22 @@ router.post(
         }
       }
 
+      for (const k of [
+        "mobile_emit_allowed_events",
+        "mobile_emit_public_events",
+      ]) {
+        const raw = form.values[k];
+        await getState().setConfig(
+          k,
+          raw
+            ? raw
+                .split(",")
+                .map((s) => s.trim())
+                .filter(Boolean)
+            : []
+        );
+        delete form.values[k];
+      }
       await getState().setConfig("event_log_settings", form.values);
 
       if (!req.xhr) res.redirect(`/eventlog/settings`);

package/routes/fields.js

@@ -333,6 +333,8 @@ const fieldFlow = (req) =>
               }
             );
           }
+          //set updated_at
+          await table.update({});
         });
         await getState().refresh_tables();
 
@@ -905,6 +907,7 @@ router.post(
     await db.withTransaction(async () => {
       await f.delete();
     });
+    await Table.findOne(table_id).update({});
     await getState().refresh_tables();
 
     req.flash("success", req.__(`Field %s deleted`, f.label));

package/routes/files.js

@@ -8,6 +8,7 @@
 const Router = require("express-promise-router");
 const File = require("@saltcorn/data/models/file");
 const User = require("@saltcorn/data/models/user");
+const View = require("@saltcorn/data/models/view");
 const Form = require("@saltcorn/data/models/form");
 const { getState } = require("@saltcorn/data/db/state");
 const s3storage = require("../s3storage");
@@ -21,6 +22,7 @@ const {
   setTenant,
   is_relative_url,
   isAdminOrHasConfigMinRole,
+  safe_redirect,
 } = require("./utils.js");
 const {
   h1,
@@ -120,6 +122,21 @@ router.get(
   error_catcher(async (req, res) => {
     const role = req.user?.role_id ? req.user.role_id : 100;
     const userId = req.user?.id;
+    const min_role_edit_files = getState().getConfig("min_role_edit_files", 1);
+    if (role > min_role_edit_files) {
+      // check if there is a use_picker set
+      let role_needed = min_role_edit_files;
+
+      const all_views = await View.find({}, { cached: true });
+      for (const view of all_views)
+        if (JSON.stringify(view.configuration).includes('"use_picker":true'))
+          role_needed = Math.max(role_needed, view.min_role);
+
+      if (role > role_needed) {
+        res.json({ error: "Not authorized" });
+        return;
+      }
+    }
     const { dir, no_subdirs, file_exts } = req.query;
     const noSubdirs = no_subdirs === "true";
     const safeDir = File.normalise(dir || "/");
@@ -687,9 +704,10 @@ router.post(
       req.flash("error", result.error);
     }
     if (!req.xhr)
-      res.redirect(
-        (is_relative_url(redirect) && redirect) ||
-          `/files?dir=${encodeURIComponent(f.current_folder)}`
+      safe_redirect(
+        res,
+        redirect,
+        `/files?dir=${encodeURIComponent(f.current_folder)}`
       );
     else res.json({ success: true });
   })
@@ -878,6 +896,7 @@ const editableExtensions = [
  */
 router.get(
   "/edit/*serve_path",
+  isAdminOrHasConfigMinRole("min_role_edit_files"),
   error_catcher(async (req, res) => {
     const role = req.user && req.user.id ? req.user.role_id : 100;
     const user_id = req.user && req.user.id;
@@ -984,6 +1003,7 @@ router.get(
  */
 router.post(
   "/edit/*serve_path",
+  isAdminOrHasConfigMinRole("min_role_edit_files"),
   error_catcher(async (req, res) => {
     const role = req.user && req.user.id ? req.user.role_id : 100;
     const user_id = req.user && req.user.id;

package/routes/packs.js

@@ -22,7 +22,6 @@ const Tag = require("@saltcorn/data/models/tag");
 const EventLog = require("@saltcorn/data/models/eventlog");
 const Model = require("@saltcorn/data/models/model");
 const ModelInstance = require("@saltcorn/data/models/model_instance");
-const load_plugins = require("../load_plugins");
 const { getState } = require("@saltcorn/data/db/state");
 const db = require("@saltcorn/data/db/index");
 const { instanceOfPack } = require("@saltcorn/types/base_types");
@@ -464,7 +463,7 @@ router.post(
     } else {
       await db.withTransaction(async () => {
         await install_pack(pack, undefined, (p) =>
-          load_plugins.loadAndSaveNewPlugin(p)
+          Plugin.loadAndSaveNewPlugin(p)
         );
       });
       await getState().refresh();
@@ -502,7 +501,7 @@ router.post(
     }
     await db.withTransaction(async () => {
       await install_pack(pack.pack, name, (p) =>
-        load_plugins.loadAndSaveNewPlugin(p)
+        Plugin.loadAndSaveNewPlugin(p)
       );
     });
     await getState().refresh();

package/routes/plugins.js

@@ -34,7 +34,6 @@ const {
   plugin_viewtemplates_info_card,
   showRepository,
 } = require("../markup/plugin-store");
-const load_plugins = require("../load_plugins");
 const {
   h5,
   a,
@@ -68,7 +67,6 @@ const {
   removeNonWordChars,
   getFetchProxyOptions,
 } = require("@saltcorn/data/utils");
-const { loadAllPlugins } = require("../load_plugins");
 const npmFetch = require("npm-registry-fetch");
 const PluginInstaller = require("@saltcorn/plugins-loader/plugin_installer");
 const {
@@ -663,7 +661,7 @@ router.get(
         const tags = pkgInfo["dist-tags"] || {};
         let selected = null;
         if (getState().plugins[plugin.name]) {
-          const mod = await load_plugins.requirePlugin(plugin);
+          const mod = await Plugin.requirePlugin(plugin);
           if (mod) selected = mod.version;
         }
         if (!selected) selected = versions[versions.length - 1];
@@ -929,7 +927,7 @@ router.post(
       const newCfg = wfres.cleanup ? wfres.context : wfres;
       plugin.configuration = newCfg;
       await plugin.upsert();
-      await load_plugins.loadPlugin(plugin);
+      await Plugin.loadPlugin(plugin);
       const instore = await Plugin.store_plugins_available();
       const store_plugin = instore.find((p) => p.name === plugin.name);
       if (store_plugin && store_plugin.has_auth) flash_restart(req);
@@ -967,7 +965,7 @@ router.post(
           ...step.renderForm.values,
         };
         await plugin.upsert();
-        await load_plugins.loadPlugin(plugin);
+        await Plugin.loadPlugin(plugin);
 
         getState().processSend({
           refresh_plugin_cfg: plugin.name,
@@ -1266,7 +1264,7 @@ router.get(
       res.redirect("/plugins");
       return;
     }
-    const mod = await load_plugins.requirePlugin(plugin_db);
+    const mod = await Plugin.requirePlugin(plugin_db);
     const store_items = await get_store_items(req);
     const store_item = store_items.find((item) => item.name === name);
     const update_permitted = plugin_db.source === "npm";
@@ -1274,16 +1272,16 @@ router.get(
     let latest =
       update_permitted &&
       (await get_latest_npm_version(plugin_db.location, 1000));
-    let engineInfos = await load_plugins.getEngineInfos(plugin_db); // with cache
+    let engineInfos = await Plugin.getEngineInfos(plugin_db); // with cache
     let forceFetch = true;
     if (latest && !engineInfos[latest]) {
-      engineInfos = await load_plugins.getEngineInfos(plugin_db, forceFetch);
+      engineInfos = await Plugin.getEngineInfos(plugin_db, forceFetch);
       forceFetch = false;
     }
     if (latest && !isVersionSupported(latest, engineInfos)) {
       latest = supportedVersion(
         latest,
-        await load_plugins.getEngineInfos(plugin_db, forceFetch)
+        await Plugin.getEngineInfos(plugin_db, forceFetch)
       );
     }
     const can_update = update_permitted && latest && mod.version !== latest;
@@ -1432,7 +1430,7 @@ router.get(
     const schema = db.getTenantSchema();
     if (schema === db.connectObj.default_schema) {
       await upgrade_all_tenants_plugins((p, f, forceFetch) =>
-        load_plugins.loadPlugin(p, f, forceFetch)
+        Plugin.loadPlugin(p, f, forceFetch)
       );
       req.flash(
         "success",
@@ -1444,11 +1442,11 @@ router.get(
       const installed_plugins = await Plugin.find({});
       for (const plugin of installed_plugins) {
         await plugin.upgrade_version((p, f, forceFetch) =>
-          load_plugins.loadPlugin(p, f, forceFetch)
+          Plugin.loadPlugin(p, f, forceFetch)
         );
       }
       req.flash("success", req.__(`Modules up-to-date`));
-      await restart_tenant(loadAllPlugins);
+      await restart_tenant(Plugin.loadAllPlugins);
       getState().processSend({
         restart_tenant: true,
         tenant: db.getTenantSchema(),
@@ -1495,10 +1493,10 @@ router.get(
     const { name } = req.params;
 
     const plugin = await Plugin.findOne({ name });
-    const versions = await load_plugins.getEngineInfos(plugin, true);
+    const versions = await Plugin.getEngineInfos(plugin, true);
 
     await plugin.upgrade_version(
-      (p, f) => load_plugins.loadPlugin(p, f),
+      (p, f) => Plugin.loadPlugin(p, f),
       supportedVersion("latest", versions, require("../package.json").version)
     );
     req.flash("success", req.__(`Module up-to-date`));
@@ -1531,7 +1529,7 @@ router.post(
       res.redirect(`/plugins`);
     } else {
       try {
-        const msgs = await load_plugins.loadAndSaveNewPlugin(
+        const msgs = await Plugin.loadAndSaveNewPlugin(
           plugin,
           schema === db.connectObj.default_schema || plugin.source === "github"
         );
@@ -1639,7 +1637,7 @@ router.post(
 
     let msgs = null;
     try {
-      msgs = await load_plugins.loadAndSaveNewPlugin(
+      msgs = await Plugin.loadAndSaveNewPlugin(
         plugin,
         forceReInstall,
         undefined,

package/routes/scapi.js

@@ -31,7 +31,6 @@ const {
   add_tenant,
 } = require("@saltcorn/data/db/state");
 const db = require("@saltcorn/data/db");
-const { loadAllPlugins } = require("../load_plugins");
 const { text } = require("@saltcorn/markup/tags");
 
 /**
@@ -346,7 +345,7 @@ router.post(
           if (new_tenant) {
             add_tenant(new_tenant);
 
-            await db.runWithTenant(new_tenant, loadAllPlugins);
+            await db.runWithTenant(new_tenant, Plugin.loadAllPlugins);
 
             process_send({ createTenant: new_tenant });
           }

package/routes/sync.js

@@ -5,6 +5,10 @@ const { getState } = require("@saltcorn/data/db/state");
 const Table = require("@saltcorn/data/models/table");
 const File = require("@saltcorn/data/models/file");
 const { getSafeSaltcornCmd } = require("@saltcorn/data/utils");
+const {
+  freeVariables,
+  add_free_variables_to_joinfields,
+} = require("@saltcorn/data/models/expression");
 const { spawn, spawnSync } = require("child_process");
 const path = require("path");
 const fs = require("fs").promises;
@@ -14,6 +18,7 @@ module.exports = router;
 
 router.get(
   "/sync_timestamp",
+  loggedIn,
   error_catcher(async (req, res) => {
     try {
       res.json({ syncTimestamp: (await db.time()).valueOf() });
@@ -24,6 +29,34 @@ router.get(
   })
 );
 
+// Apply ownership_formula filter to rows fetched by getSyncRows.
+// For formulas that reference join fields, resolves them via a second
+// getJoinedRows pass bounded to the PKs already in the result set.
+const applyOwnershipFormula = async (rows, table, user) => {
+  if (!rows.length) return rows;
+  const pkName = table.pk_name;
+  const joinFields = {};
+  add_free_variables_to_joinfields(
+    freeVariables(table.ownership_formula),
+    joinFields,
+    table.getFields()
+  );
+  let rowMap = null;
+  if (Object.keys(joinFields).length > 0) {
+    const pks = rows.map((r) => r[pkName]);
+    const joinedRows = await table.getJoinedRows({
+      where: { [pkName]: { in: pks } },
+      joinFields,
+    });
+    rowMap = Object.fromEntries(joinedRows.map((r) => [r[pkName], r]));
+  }
+  // table.ownership_formula
+  return rows.filter((row) => {
+    const evalRow = rowMap ? rowMap[row[pkName]] ?? row : row;
+    return table.is_owner(user, evalRow);
+  });
+};
+
 const getSyncRows = async (syncInfo, table, syncUntil, user) => {
   const tblName = table.name;
   const pkName = table.pk_name;
@@ -48,64 +81,90 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
     }
     ownerFieldName = ownerField.name;
   }
+
+  const maxLoadedId = Number(syncInfo.maxLoadedId);
+  if (!Number.isInteger(maxLoadedId)) throw new Error("Invalid maxLoadedId");
+
+  const syncUntilMs = new Date(syncUntil).valueOf();
+  if (!Number.isFinite(syncUntilMs)) throw new Error("Invalid syncUntil");
+
+  const userId = user?.id !== undefined ? parseInt(user.id, 10) : null;
+  if (ownerFieldName && !Number.isFinite(userId))
+    throw new Error("Invalid user id");
+
   const schema = db.getTenantSchemaPrefix();
   if (!syncInfo.syncFrom) {
+    const params = [maxLoadedId];
+    const ownerClause = ownerFieldName
+      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $2`
+      : "";
+    if (ownerFieldName) params.push(userId);
     const { rows } = await db.query(
-      `select 
-         info_tbl.ref "_sync_info_tbl_ref_", 
-         info_tbl.last_modified "_sync_info_tbl_last_modified_", 
+      `select
+         info_tbl.ref "_sync_info_tbl_ref_",
+         info_tbl.last_modified "_sync_info_tbl_last_modified_",
          info_tbl.deleted "_sync_info_tbl_deleted_",
          data_tbl.*
        from ${schema}"${db.sqlsanitize(
-         tblName
-       )}_sync_info" "info_tbl" right join "${db.sqlsanitize(
-         tblName
-       )}" "data_tbl"
+        tblName
+      )}_sync_info" "info_tbl" right join "${db.sqlsanitize(
+        tblName
+      )}" "data_tbl"
       on info_tbl.ref = data_tbl."${db.sqlsanitize(
         pkName
       )}" and info_tbl.deleted = false
-      where data_tbl."${db.sqlsanitize(pkName)}" > ${syncInfo.maxLoadedId}
-      ${ownerFieldName ? `and data_tbl."${ownerFieldName}" = ${user.id}` : ""}
-      order by data_tbl."${db.sqlsanitize(pkName)}"`
+      where data_tbl."${db.sqlsanitize(pkName)}" > $1
+      ${ownerClause}
+      order by data_tbl."${db.sqlsanitize(pkName)}"`,
+      params
     );
     for (const row of rows) {
       if (row._sync_info_tbl_last_modified_)
         row._sync_info_tbl_last_modified_ =
           row._sync_info_tbl_last_modified_.valueOf();
-      else row._sync_info_tbl_last_modified_ = new Date(syncUntil).valueOf();
+      else row._sync_info_tbl_last_modified_ = syncUntilMs;
       row._sync_info_tbl_ref_ = row[pkName];
     }
+    if (table.ownership_formula && role > minRole)
+      return applyOwnershipFormula(rows, table, user);
     return rows;
   } else {
+    const syncFromMs = new Date(syncInfo.syncFrom).valueOf();
+    if (!Number.isFinite(syncFromMs)) throw new Error("Invalid syncFrom");
+
+    const params = [syncFromMs / 1000.0, syncUntilMs / 1000.0, maxLoadedId];
+    const ownerClause = ownerFieldName
+      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $4`
+      : "";
+    if (ownerFieldName) params.push(userId);
     const { rows } = await db.query(
-      `select 
-         info_tbl.ref "_sync_info_tbl_ref_", 
-         info_tbl.last_modified "_sync_info_tbl_last_modified_", 
+      `select
+         info_tbl.ref "_sync_info_tbl_ref_",
+         info_tbl.last_modified "_sync_info_tbl_last_modified_",
          info_tbl.deleted "_sync_info_tbl_deleted_",
          data_tbl.*
        from ${schema}"${db.sqlsanitize(
-         tblName
-       )}_sync_info" "info_tbl" join ${schema}"${db.sqlsanitize(
-         tblName
-       )}" "data_tbl"
+        tblName
+      )}_sync_info" "info_tbl" join ${schema}"${db.sqlsanitize(
+        tblName
+      )}" "data_tbl"
       on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"
-      where date_trunc('milliseconds', info_tbl.last_modified) > to_timestamp(${
-        new Date(syncInfo.syncFrom).valueOf() / 1000.0
-      }) 
-      and date_trunc('milliseconds', info_tbl.last_modified) < to_timestamp(${
-        new Date(syncUntil).valueOf() / 1000.0
-      }) 
+      where date_trunc('milliseconds', info_tbl.last_modified) > to_timestamp($1)
+      and date_trunc('milliseconds', info_tbl.last_modified) < to_timestamp($2)
       and info_tbl.deleted = false
-      and info_tbl.ref > ${syncInfo.maxLoadedId}
-      ${ownerFieldName ? `and data_tbl."${ownerFieldName}" = ${user.id}` : ""}
-      order by info_tbl.ref`
+      and info_tbl.ref > $3
+      ${ownerClause}
+      order by info_tbl.ref`,
+      params
     );
     for (const row of rows) {
       if (row._sync_info_tbl_last_modified_)
         row._sync_info_tbl_last_modified_ =
           row._sync_info_tbl_last_modified_.valueOf();
-      else row._sync_info_tbl_last_modified_ = syncUntil.valueOf();
+      else row._sync_info_tbl_last_modified_ = syncUntilMs;
     }
+    if (table.ownership_formula && role > minRole)
+      return applyOwnershipFormula(rows, table, user);
     return rows;
   }
 };
@@ -116,6 +175,7 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
 */
 router.post(
   "/load_changes",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { syncInfos, loadUntil } = req.body || {};
     if (!loadUntil) {
@@ -135,6 +195,8 @@ router.post(
         for (const [tblName, syncInfo] of Object.entries(syncInfos)) {
           const table = Table.findOne({ name: tblName });
           if (!table) throw new Error(`The table '${tblName}' does not exists`);
+          if (!table.has_sync_info)
+            throw new Error(`The table '${tblName}' has no sync info`);
           const pkName = table.pk_name;
           let rows = await getSyncRows(syncInfo, table, loadUntil, req.user);
           if (!rows) continue;
@@ -146,7 +208,7 @@ router.post(
               continue;
             else if (table.ownership_field_id) {
             } else if (table.ownership_formula) {
-              rows = rows.filter((row) => table.is_owner(req.user, row));
+              // already filtered by applyOwnershipFormula inside getSyncRows
             }
           }
           if (rows.length > rowLimit) {
@@ -168,17 +230,25 @@ router.post(
   })
 );
 
-const getDelRows = async (tblName, syncFrom, syncUntil) => {
+const getDelRows = async (tblName, syncFrom, syncUntil, userId = null) => {
+  const syncFromMs = syncFrom.valueOf();
+  const syncUntilMs = syncUntil.valueOf();
+  if (!Number.isFinite(syncFromMs)) throw new Error("Invalid syncFrom");
+  if (!Number.isFinite(syncUntilMs)) throw new Error("Invalid syncUntil");
   const schema = db.getTenantSchemaPrefix();
+  const ownerFilter =
+    userId !== null ? `and alias.owner_id = ${parseInt(userId)}` : "";
   const dbRes = await db.query(
-    `select * 
+    `select *
      from (
-      select ref, max(last_modified) from ${schema}"${db.sqlsanitize(
-        tblName
-      )}_sync_info" 
-      group by ref, deleted having deleted = true) as alias 
-      where alias.max < to_timestamp(${syncUntil.valueOf() / 1000.0}) 
-        and alias.max > to_timestamp(${syncFrom.valueOf() / 1000.0})`
+      select ref, max(last_modified), owner_id, owner_fields from ${schema}"${db.sqlsanitize(
+      tblName
+    )}_sync_info"
+      group by ref, deleted, owner_id, owner_fields having deleted = true) as alias
+      where alias.max < to_timestamp($1)
+        and alias.max > to_timestamp($2)
+        ${ownerFilter}`,
+    [syncUntilMs / 1000.0, syncFromMs / 1000.0]
   );
   for (const row of dbRes.rows) {
     if (row.last_modified) row.last_modified = row.last_modified.valueOf();
@@ -193,8 +263,10 @@ const getDelRows = async (tblName, syncFrom, syncUntil) => {
 */
 router.post(
   "/deletes",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { syncInfos, syncTimestamp } = req.body || {};
+    const role = req.user ? req.user.role_id : 100;
     try {
       const result = await db.withTransaction(async () => {
         const syncUntil = new Date(syncTimestamp);
@@ -202,6 +274,35 @@ router.post(
           deletes: {},
         };
         for (const [tblName, syncInfo] of Object.entries(syncInfos)) {
+          const table = Table.findOne({ name: tblName });
+          if (!table) throw new Error(`The table '${tblName}' does not exists`);
+          if (!table.has_sync_info)
+            throw new Error(`The table '${tblName}' has no sync info`);
+          if (role > table.min_role_read) {
+            if (!table.ownership_field_id && !table.ownership_formula) continue;
+            if (!syncInfo.syncFrom) continue;
+            if (table.ownership_field_id) {
+              // Filter by owner_id in SQL
+              result.deletes[tblName] = await getDelRows(
+                tblName,
+                new Date(syncInfo.syncFrom),
+                syncUntil,
+                req.user.id
+              );
+            } else {
+              // ownership_formula: fetch all deletes and evaluate formula in JS
+              // against the field values stored in owner_fields at delete time
+              const rows = await getDelRows(
+                tblName,
+                new Date(syncInfo.syncFrom),
+                syncUntil
+              );
+              result.deletes[tblName] = rows.filter((row) =>
+                table.is_owner(req.user, row.owner_fields || {})
+              );
+            }
+            continue;
+          }
           if (syncInfo.syncFrom) {
             result.deletes[tblName] = await getDelRows(
               tblName,
@@ -225,17 +326,19 @@ router.post(
 */
 router.post(
   "/offline_changes",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { changes, newSyncTimestamp, oldSyncTimestamp } = req.body || {};
     const rootFolder = await File.rootFolder();
     try {
       const syncDirName = `${newSyncTimestamp}_${req.user?.email || "public"}`;
-      const syncDir = path.join(
-        rootFolder.location,
-        "mobile_app",
-        "sync",
+      const syncDir = File.normalise_in_base(
+        path.join(rootFolder.location, "mobile_app", "sync"),
         syncDirName
       );
+      if (!syncDir) {
+        return res.status(400).json({ error: "Invalid sync directory name" });
+      }
       await fs.mkdir(syncDir, { recursive: true });
       await fs.writeFile(
         path.join(syncDir, "changes.json"),
@@ -287,16 +390,23 @@ const readOutFile = async (entries, syncDir, fileName) => {
 
 router.get(
   "/upload_finished",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { dir_name } = req.query;
     try {
+      const expectedEmail = req.user?.email || "public";
+      const dirMatch = dir_name ? dir_name.match(/^\d+_(.+)$/) : null;
+      if (!dirMatch || dirMatch[1] !== expectedEmail) {
+        return res.status(403).json({ error: "Access denied" });
+      }
       const rootFolder = await File.rootFolder();
-      const syncDir = path.join(
-        rootFolder.location,
-        "mobile_app",
-        "sync",
+      const syncDir = File.normalise_in_base(
+        path.join(rootFolder.location, "mobile_app", "sync"),
         dir_name
       );
+      if (!syncDir) {
+        return res.json({ finished: false });
+      }
       let entries = null;
       try {
         entries = await fs.readdir(syncDir);
@@ -340,9 +450,15 @@ router.get(
 
 router.post(
   "/clean_sync_dir",
+  loggedIn,
   error_catcher(async (req, res) => {
     const { dir_name } = req.body || {};
     try {
+      const expectedEmail = req.user?.email || "public";
+      const dirMatch = dir_name ? dir_name.match(/^\d+_(.+)$/) : null;
+      if (!dirMatch || dirMatch[1] !== expectedEmail) {
+        return res.status(403).json({ error: "Access denied" });
+      }
       const rootFolder = await File.rootFolder();
       const syncDir = File.normalise_in_base(
         path.join(rootFolder.location, "mobile_app", "sync"),

package/routes/tables.js

@@ -1946,6 +1946,8 @@ router.post(
           configuration,
         });
       });
+      // set updated_at
+      await table.update({});
       await getState().refresh_tables();
 
       Trigger.emitEvent(
@@ -2072,6 +2074,8 @@ router.post(
     await db.withTransaction(async () => {
       await cons.delete();
     });
+    //set updated_at
+    await Table.findOne(cons.table_id).update({});
     await getState().refresh_tables();
     res.redirect(`/table/constraints/${cons.table_id}`);
   })