@saltcorn/server 1.6.0-beta.4 → 1.6.0-beta.6

package/routes/fields.js

@@ -333,6 +333,8 @@ const fieldFlow = (req) =>
               }
             );
           }
+          //set updated_at
+          await table.update({});
         });
         await getState().refresh_tables();
 
@@ -905,6 +907,7 @@ router.post(
     await db.withTransaction(async () => {
       await f.delete();
     });
+    await Table.findOne(table_id).update({});
     await getState().refresh_tables();
 
     req.flash("success", req.__(`Field %s deleted`, f.label));
@@ -1345,6 +1348,7 @@ router.post(
         undefined,
         req.user
       );
+    if (fv?.fill_options) await fv.fill_options(field);
     if (!fv && field.type === "Key" && fieldview === "select")
       res.send(
         `<input ${

package/routes/files.js

@@ -22,6 +22,7 @@ const {
   setTenant,
   is_relative_url,
   isAdminOrHasConfigMinRole,
+  safe_redirect,
 } = require("./utils.js");
 const {
   h1,
@@ -182,10 +183,11 @@ router.get(
       file.location = file.isDirectory ? file.path_to_serve : file.field_value;
     }
     if (file_exts) {
+      const escapeRegex = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
       const re = new RegExp(
         `\\.(${file_exts
           .split(",")
-          .map((s) => s.trim())
+          .map((s) => escapeRegex(s.trim()))
           .join("|")})$`,
         "i"
       );
@@ -486,6 +488,17 @@ router.get(
       const width = strictParseInt(width_str);
       const height =
         height_str && height_str !== "0" ? strictParseInt(height_str) : null;
+      if (
+        file.mimetype === "image/svg+xml" ||
+        file.mimetype === "application/mathml+xml"
+      ) {
+        const window = new JSDOM("").window;
+        const DOMPurify = createDOMPurify(window);
+        const contents = await fs.promises.readFile(file.location);
+        const clean = DOMPurify.sanitize(contents);
+        res.send(clean);
+        return;
+      }
       if (!width) {
         res.sendFile(file.location, { dotfiles: "allow" });
         return;
@@ -703,9 +716,10 @@ router.post(
       req.flash("error", result.error);
     }
     if (!req.xhr)
-      res.redirect(
-        (is_relative_url(redirect) && redirect) ||
-          `/files?dir=${encodeURIComponent(f.current_folder)}`
+      safe_redirect(
+        res,
+        redirect,
+        `/files?dir=${encodeURIComponent(f.current_folder)}`
       );
     else res.json({ success: true });
   })

package/routes/packs.js

@@ -22,7 +22,6 @@ const Tag = require("@saltcorn/data/models/tag");
 const EventLog = require("@saltcorn/data/models/eventlog");
 const Model = require("@saltcorn/data/models/model");
 const ModelInstance = require("@saltcorn/data/models/model_instance");
-const load_plugins = require("../load_plugins");
 const { getState } = require("@saltcorn/data/db/state");
 const db = require("@saltcorn/data/db/index");
 const { instanceOfPack } = require("@saltcorn/types/base_types");
@@ -464,7 +463,7 @@ router.post(
     } else {
       await db.withTransaction(async () => {
         await install_pack(pack, undefined, (p) =>
-          load_plugins.loadAndSaveNewPlugin(p)
+          Plugin.loadAndSaveNewPlugin(p)
         );
       });
       await getState().refresh();
@@ -502,7 +501,7 @@ router.post(
     }
     await db.withTransaction(async () => {
       await install_pack(pack.pack, name, (p) =>
-        load_plugins.loadAndSaveNewPlugin(p)
+        Plugin.loadAndSaveNewPlugin(p)
       );
     });
     await getState().refresh();

package/routes/plugins.js

@@ -34,7 +34,6 @@ const {
   plugin_viewtemplates_info_card,
   showRepository,
 } = require("../markup/plugin-store");
-const load_plugins = require("../load_plugins");
 const {
   h5,
   a,
@@ -68,7 +67,6 @@ const {
   removeNonWordChars,
   getFetchProxyOptions,
 } = require("@saltcorn/data/utils");
-const { loadAllPlugins } = require("../load_plugins");
 const npmFetch = require("npm-registry-fetch");
 const PluginInstaller = require("@saltcorn/plugins-loader/plugin_installer");
 const {
@@ -191,7 +189,17 @@ const get_store_items = async (req) => {
   if (msgs.length > 0) req.flash("warning", msgs.join("<br>"));
   const packs_available = await fetch_available_packs();
   const packs_installed = getState().getConfig("installed_packs", []);
-  const installed_plugin_names = installed_plugins.map((p) => p.name);
+  const tenants_install_git = getRootState().getConfig(
+    "tenants_install_git",
+    false
+  );
+  const isGitBlocked = (p) =>
+    !isRoot &&
+    !tenants_install_git &&
+    (p.source === "git" || p.source === "github");
+  const installed_plugin_names = installed_plugins
+    .filter((p) => !isGitBlocked(p))
+    .map((p) => p.name);
   const store_plugin_names = instore.map((p) => p.name);
   const plugins_item = instore
     .map((plugin) => ({
@@ -210,7 +218,12 @@ const get_store_items = async (req) => {
     }))
     .filter((p) => !p.unsafe || isRoot || tenants_unsafe_plugins);
   const local_logins = installed_plugins
-    .filter((p) => !store_plugin_names.includes(p.name) && p.name !== "base")
+    .filter(
+      (p) =>
+        !store_plugin_names.includes(p.name) &&
+        p.name !== "base" &&
+        !isGitBlocked(p)
+    )
     .map((plugin) => ({
       name: plugin.name,
       installed: true,
@@ -663,7 +676,7 @@ router.get(
         const tags = pkgInfo["dist-tags"] || {};
         let selected = null;
         if (getState().plugins[plugin.name]) {
-          const mod = await load_plugins.requirePlugin(plugin);
+          const mod = await Plugin.requirePlugin(plugin);
           if (mod) selected = mod.version;
         }
         if (!selected) selected = versions[versions.length - 1];
@@ -929,7 +942,7 @@ router.post(
       const newCfg = wfres.cleanup ? wfres.context : wfres;
       plugin.configuration = newCfg;
       await plugin.upsert();
-      await load_plugins.loadPlugin(plugin);
+      await Plugin.loadPlugin(plugin);
       const instore = await Plugin.store_plugins_available();
       const store_plugin = instore.find((p) => p.name === plugin.name);
       if (store_plugin && store_plugin.has_auth) flash_restart(req);
@@ -967,7 +980,7 @@ router.post(
           ...step.renderForm.values,
         };
         await plugin.upsert();
-        await load_plugins.loadPlugin(plugin);
+        await Plugin.loadPlugin(plugin);
 
         getState().processSend({
           refresh_plugin_cfg: plugin.name,
@@ -1266,7 +1279,7 @@ router.get(
       res.redirect("/plugins");
       return;
     }
-    const mod = await load_plugins.requirePlugin(plugin_db);
+    const mod = await Plugin.requirePlugin(plugin_db);
     const store_items = await get_store_items(req);
     const store_item = store_items.find((item) => item.name === name);
     const update_permitted = plugin_db.source === "npm";
@@ -1274,16 +1287,16 @@ router.get(
     let latest =
       update_permitted &&
       (await get_latest_npm_version(plugin_db.location, 1000));
-    let engineInfos = await load_plugins.getEngineInfos(plugin_db); // with cache
+    let engineInfos = await Plugin.getEngineInfos(plugin_db); // with cache
     let forceFetch = true;
     if (latest && !engineInfos[latest]) {
-      engineInfos = await load_plugins.getEngineInfos(plugin_db, forceFetch);
+      engineInfos = await Plugin.getEngineInfos(plugin_db, forceFetch);
       forceFetch = false;
     }
     if (latest && !isVersionSupported(latest, engineInfos)) {
       latest = supportedVersion(
         latest,
-        await load_plugins.getEngineInfos(plugin_db, forceFetch)
+        await Plugin.getEngineInfos(plugin_db, forceFetch)
       );
     }
     const can_update = update_permitted && latest && mod.version !== latest;
@@ -1432,7 +1445,7 @@ router.get(
     const schema = db.getTenantSchema();
     if (schema === db.connectObj.default_schema) {
       await upgrade_all_tenants_plugins((p, f, forceFetch) =>
-        load_plugins.loadPlugin(p, f, forceFetch)
+        Plugin.loadPlugin(p, f, forceFetch)
       );
       req.flash(
         "success",
@@ -1444,11 +1457,11 @@ router.get(
       const installed_plugins = await Plugin.find({});
       for (const plugin of installed_plugins) {
         await plugin.upgrade_version((p, f, forceFetch) =>
-          load_plugins.loadPlugin(p, f, forceFetch)
+          Plugin.loadPlugin(p, f, forceFetch)
         );
       }
       req.flash("success", req.__(`Modules up-to-date`));
-      await restart_tenant(loadAllPlugins);
+      await restart_tenant(Plugin.loadAllPlugins);
       getState().processSend({
         restart_tenant: true,
         tenant: db.getTenantSchema(),
@@ -1495,10 +1508,10 @@ router.get(
     const { name } = req.params;
 
     const plugin = await Plugin.findOne({ name });
-    const versions = await load_plugins.getEngineInfos(plugin, true);
+    const versions = await Plugin.getEngineInfos(plugin, true);
 
     await plugin.upgrade_version(
-      (p, f) => load_plugins.loadPlugin(p, f),
+      (p, f) => Plugin.loadPlugin(p, f),
       supportedVersion("latest", versions, require("../package.json").version)
     );
     req.flash("success", req.__(`Module up-to-date`));
@@ -1531,7 +1544,7 @@ router.post(
       res.redirect(`/plugins`);
     } else {
       try {
-        const msgs = await load_plugins.loadAndSaveNewPlugin(
+        const msgs = await Plugin.loadAndSaveNewPlugin(
           plugin,
           schema === db.connectObj.default_schema || plugin.source === "github"
         );
@@ -1639,7 +1652,7 @@ router.post(
 
     let msgs = null;
     try {
-      msgs = await load_plugins.loadAndSaveNewPlugin(
+      msgs = await Plugin.loadAndSaveNewPlugin(
         plugin,
         forceReInstall,
         undefined,
@@ -1679,3 +1692,5 @@ router.post(
     }
   })
 );
+
+router.get_store_items = get_store_items;

package/routes/scapi.js

@@ -31,7 +31,6 @@ const {
   add_tenant,
 } = require("@saltcorn/data/db/state");
 const db = require("@saltcorn/data/db");
-const { loadAllPlugins } = require("../load_plugins");
 const { text } = require("@saltcorn/markup/tags");
 
 /**
@@ -346,7 +345,7 @@ router.post(
           if (new_tenant) {
             add_tenant(new_tenant);
 
-            await db.runWithTenant(new_tenant, loadAllPlugins);
+            await db.runWithTenant(new_tenant, Plugin.loadAllPlugins);
 
             process_send({ createTenant: new_tenant });
           }

package/routes/sync.js

@@ -5,6 +5,10 @@ const { getState } = require("@saltcorn/data/db/state");
 const Table = require("@saltcorn/data/models/table");
 const File = require("@saltcorn/data/models/file");
 const { getSafeSaltcornCmd } = require("@saltcorn/data/utils");
+const {
+  freeVariables,
+  add_free_variables_to_joinfields,
+} = require("@saltcorn/data/models/expression");
 const { spawn, spawnSync } = require("child_process");
 const path = require("path");
 const fs = require("fs").promises;
@@ -25,6 +29,34 @@ router.get(
   })
 );
 
+// Apply ownership_formula filter to rows fetched by getSyncRows.
+// For formulas that reference join fields, resolves them via a second
+// getJoinedRows pass bounded to the PKs already in the result set.
+const applyOwnershipFormula = async (rows, table, user) => {
+  if (!rows.length) return rows;
+  const pkName = table.pk_name;
+  const joinFields = {};
+  add_free_variables_to_joinfields(
+    freeVariables(table.ownership_formula),
+    joinFields,
+    table.getFields()
+  );
+  let rowMap = null;
+  if (Object.keys(joinFields).length > 0) {
+    const pks = rows.map((r) => r[pkName]);
+    const joinedRows = await table.getJoinedRows({
+      where: { [pkName]: { in: pks } },
+      joinFields,
+    });
+    rowMap = Object.fromEntries(joinedRows.map((r) => [r[pkName], r]));
+  }
+  // table.ownership_formula
+  return rows.filter((row) => {
+    const evalRow = rowMap ? rowMap[row[pkName]] ?? row : row;
+    return table.is_owner(user, evalRow);
+  });
+};
+
 const getSyncRows = async (syncInfo, table, syncUntil, user) => {
   const tblName = table.name;
   const pkName = table.pk_name;
@@ -49,64 +81,101 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
     }
     ownerFieldName = ownerField.name;
   }
+
+  // Time-based composite cursor: (lastModifiedAt ms, lastRef string).
+  // Works for both integer and UUID primary keys.
+  const lastModifiedAt = Number(syncInfo.lastModifiedAt ?? 0);
+  if (!Number.isInteger(lastModifiedAt) || lastModifiedAt < 0)
+    throw new Error("Invalid lastModifiedAt");
+  const lastRef = String(syncInfo.lastRef ?? "");
+
+  const syncUntilMs = new Date(syncUntil).valueOf();
+  if (!Number.isFinite(syncUntilMs)) throw new Error("Invalid syncUntil");
+
+  const userId = user?.id !== undefined ? parseInt(user.id, 10) : null;
+  if (ownerFieldName && !Number.isFinite(userId))
+    throw new Error("Invalid user id");
+
   const schema = db.getTenantSchemaPrefix();
   if (!syncInfo.syncFrom) {
+    // First sync: all non-deleted rows after the cursor, ordered by
+    // (last_modified, ref) so pagination is stable across PK types.
+    const params = [lastModifiedAt / 1000.0, lastRef];
+    const ownerClause = ownerFieldName
+      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $3`
+      : "";
+    if (ownerFieldName) params.push(userId);
     const { rows } = await db.query(
-      `select 
-         info_tbl.ref "_sync_info_tbl_ref_", 
-         info_tbl.last_modified "_sync_info_tbl_last_modified_", 
-         info_tbl.deleted "_sync_info_tbl_deleted_",
+      `select
+         COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text) "_sync_info_tbl_ref_",
+         info_tbl.last_modified "_sync_info_tbl_last_modified_",
+         COALESCE(info_tbl.deleted, false) "_sync_info_tbl_deleted_",
          data_tbl.*
-       from ${schema}"${db.sqlsanitize(
-         tblName
-       )}_sync_info" "info_tbl" right join "${db.sqlsanitize(
-         tblName
-       )}" "data_tbl"
-      on info_tbl.ref = data_tbl."${db.sqlsanitize(
-        pkName
-      )}" and info_tbl.deleted = false
-      where data_tbl."${db.sqlsanitize(pkName)}" > ${syncInfo.maxLoadedId}
-      ${ownerFieldName ? `and data_tbl."${ownerFieldName}" = ${user.id}` : ""}
-      order by data_tbl."${db.sqlsanitize(pkName)}"`
+       from ${schema}"${db.sqlsanitize(tblName)}_sync_info" "info_tbl"
+       right join "${db.sqlsanitize(tblName)}" "data_tbl"
+         on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"::text
+         and info_tbl.deleted = false
+       where (
+           COALESCE(info_tbl.last_modified, to_timestamp(0)),
+           COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text)
+         ) > (to_timestamp($1), $2)
+       ${ownerClause}
+       order by
+         COALESCE(info_tbl.last_modified, to_timestamp(0)),
+         COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text)`,
+      params
     );
     for (const row of rows) {
       if (row._sync_info_tbl_last_modified_)
         row._sync_info_tbl_last_modified_ =
           row._sync_info_tbl_last_modified_.valueOf();
-      else row._sync_info_tbl_last_modified_ = new Date(syncUntil).valueOf();
+      else row._sync_info_tbl_last_modified_ = syncUntilMs;
       row._sync_info_tbl_ref_ = row[pkName];
     }
+    if (table.ownership_formula && role > minRole)
+      return applyOwnershipFormula(rows, table, user);
     return rows;
   } else {
+    const syncFromMs = new Date(syncInfo.syncFrom).valueOf();
+    if (!Number.isFinite(syncFromMs)) throw new Error("Invalid syncFrom");
+
+    // Incremental sync: rows changed in the time window, paged by
+    // (last_modified, ref) within the window.
+    const params = [
+      syncFromMs / 1000.0,
+      syncUntilMs / 1000.0,
+      lastModifiedAt / 1000.0,
+      lastRef,
+    ];
+    const ownerClause = ownerFieldName
+      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $5`
+      : "";
+    if (ownerFieldName) params.push(userId);
     const { rows } = await db.query(
-      `select 
-         info_tbl.ref "_sync_info_tbl_ref_", 
-         info_tbl.last_modified "_sync_info_tbl_last_modified_", 
+      `select
+         info_tbl.ref "_sync_info_tbl_ref_",
+         info_tbl.last_modified "_sync_info_tbl_last_modified_",
          info_tbl.deleted "_sync_info_tbl_deleted_",
          data_tbl.*
-       from ${schema}"${db.sqlsanitize(
-         tblName
-       )}_sync_info" "info_tbl" join ${schema}"${db.sqlsanitize(
-         tblName
-       )}" "data_tbl"
-      on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"
-      where date_trunc('milliseconds', info_tbl.last_modified) > to_timestamp(${
-        new Date(syncInfo.syncFrom).valueOf() / 1000.0
-      }) 
-      and date_trunc('milliseconds', info_tbl.last_modified) < to_timestamp(${
-        new Date(syncUntil).valueOf() / 1000.0
-      }) 
-      and info_tbl.deleted = false
-      and info_tbl.ref > ${syncInfo.maxLoadedId}
-      ${ownerFieldName ? `and data_tbl."${ownerFieldName}" = ${user.id}` : ""}
-      order by info_tbl.ref`
+       from ${schema}"${db.sqlsanitize(tblName)}_sync_info" "info_tbl"
+       join ${schema}"${db.sqlsanitize(tblName)}" "data_tbl"
+         on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"::text
+       where date_trunc('milliseconds', info_tbl.last_modified) > to_timestamp($1)
+         and date_trunc('milliseconds', info_tbl.last_modified) < to_timestamp($2)
+         and info_tbl.deleted = false
+         and (info_tbl.last_modified, info_tbl.ref) > (to_timestamp($3), $4)
+       ${ownerClause}
+       order by info_tbl.last_modified, info_tbl.ref`,
+      params
     );
     for (const row of rows) {
       if (row._sync_info_tbl_last_modified_)
         row._sync_info_tbl_last_modified_ =
           row._sync_info_tbl_last_modified_.valueOf();
-      else row._sync_info_tbl_last_modified_ = syncUntil.valueOf();
+      else row._sync_info_tbl_last_modified_ = syncUntilMs;
     }
+    if (table.ownership_formula && role > minRole)
+      return applyOwnershipFormula(rows, table, user);
     return rows;
   }
 };
@@ -137,6 +206,8 @@ router.post(
         for (const [tblName, syncInfo] of Object.entries(syncInfos)) {
           const table = Table.findOne({ name: tblName });
           if (!table) throw new Error(`The table '${tblName}' does not exists`);
+          if (!table.has_sync_info)
+            throw new Error(`The table '${tblName}' has no sync info`);
           const pkName = table.pk_name;
           let rows = await getSyncRows(syncInfo, table, loadUntil, req.user);
           if (!rows) continue;
@@ -148,16 +219,18 @@ router.post(
               continue;
             else if (table.ownership_field_id) {
             } else if (table.ownership_formula) {
-              rows = rows.filter((row) => table.is_owner(req.user, row));
+              // already filtered by applyOwnershipFormula inside getSyncRows
             }
           }
           if (rows.length > rowLimit) {
             rows.splice(rowLimit);
           }
           rowLimit -= rows.length;
+          const lastRow = rows.length > 0 ? rows[rows.length - 1] : null;
           result[tblName] = {
             rows,
-            maxLoadedId: rows.length > 0 ? rows[rows.length - 1][pkName] : 0,
+            maxModifiedAt: lastRow ? lastRow._sync_info_tbl_last_modified_ : 0,
+            maxRef: lastRow ? String(lastRow._sync_info_tbl_ref_ ?? "") : "",
           };
         }
         return result;
@@ -170,17 +243,25 @@ router.post(
   })
 );
 
-const getDelRows = async (tblName, syncFrom, syncUntil) => {
+const getDelRows = async (tblName, syncFrom, syncUntil, userId = null) => {
+  const syncFromMs = syncFrom.valueOf();
+  const syncUntilMs = syncUntil.valueOf();
+  if (!Number.isFinite(syncFromMs)) throw new Error("Invalid syncFrom");
+  if (!Number.isFinite(syncUntilMs)) throw new Error("Invalid syncUntil");
   const schema = db.getTenantSchemaPrefix();
+  const ownerFilter =
+    userId !== null ? `and alias.owner_id = ${parseInt(userId)}` : "";
   const dbRes = await db.query(
-    `select * 
+    `select *
      from (
-      select ref, max(last_modified) from ${schema}"${db.sqlsanitize(
-        tblName
-      )}_sync_info" 
-      group by ref, deleted having deleted = true) as alias 
-      where alias.max < to_timestamp(${syncUntil.valueOf() / 1000.0}) 
-        and alias.max > to_timestamp(${syncFrom.valueOf() / 1000.0})`
+      select ref, max(last_modified), owner_id, owner_fields from ${schema}"${db.sqlsanitize(
+      tblName
+    )}_sync_info"
+      group by ref, deleted, owner_id, owner_fields having deleted = true) as alias
+      where alias.max < to_timestamp($1)
+        and alias.max > to_timestamp($2)
+        ${ownerFilter}`,
+    [syncUntilMs / 1000.0, syncFromMs / 1000.0]
   );
   for (const row of dbRes.rows) {
     if (row.last_modified) row.last_modified = row.last_modified.valueOf();
@@ -198,6 +279,7 @@ router.post(
   loggedIn,
   error_catcher(async (req, res) => {
     const { syncInfos, syncTimestamp } = req.body || {};
+    const role = req.user ? req.user.role_id : 100;
     try {
       const result = await db.withTransaction(async () => {
         const syncUntil = new Date(syncTimestamp);
@@ -205,6 +287,35 @@ router.post(
           deletes: {},
         };
         for (const [tblName, syncInfo] of Object.entries(syncInfos)) {
+          const table = Table.findOne({ name: tblName });
+          if (!table) throw new Error(`The table '${tblName}' does not exists`);
+          if (!table.has_sync_info)
+            throw new Error(`The table '${tblName}' has no sync info`);
+          if (role > table.min_role_read) {
+            if (!table.ownership_field_id && !table.ownership_formula) continue;
+            if (!syncInfo.syncFrom) continue;
+            if (table.ownership_field_id) {
+              // Filter by owner_id in SQL
+              result.deletes[tblName] = await getDelRows(
+                tblName,
+                new Date(syncInfo.syncFrom),
+                syncUntil,
+                req.user.id
+              );
+            } else {
+              // ownership_formula: fetch all deletes and evaluate formula in JS
+              // against the field values stored in owner_fields at delete time
+              const rows = await getDelRows(
+                tblName,
+                new Date(syncInfo.syncFrom),
+                syncUntil
+              );
+              result.deletes[tblName] = rows.filter((row) =>
+                table.is_owner(req.user, row.owner_fields || {})
+              );
+            }
+            continue;
+          }
           if (syncInfo.syncFrom) {
             result.deletes[tblName] = await getDelRows(
               tblName,
@@ -296,8 +407,9 @@ router.get(
   error_catcher(async (req, res) => {
     const { dir_name } = req.query;
     try {
-      const expectedSuffix = `_${req.user?.email || "public"}`;
-      if (!dir_name || !dir_name.endsWith(expectedSuffix)) {
+      const expectedEmail = req.user?.email || "public";
+      const dirMatch = dir_name ? dir_name.match(/^\d+_(.+)$/) : null;
+      if (!dirMatch || dirMatch[1] !== expectedEmail) {
         return res.status(403).json({ error: "Access denied" });
       }
       const rootFolder = await File.rootFolder();
@@ -355,8 +467,9 @@ router.post(
   error_catcher(async (req, res) => {
     const { dir_name } = req.body || {};
     try {
-      const expectedSuffix = `_${req.user?.email || "public"}`;
-      if (!dir_name || !dir_name.endsWith(expectedSuffix)) {
+      const expectedEmail = req.user?.email || "public";
+      const dirMatch = dir_name ? dir_name.match(/^\d+_(.+)$/) : null;
+      if (!dirMatch || dirMatch[1] !== expectedEmail) {
         return res.status(403).json({ error: "Access denied" });
       }
       const rootFolder = await File.rootFolder();

package/routes/tables.js

@@ -1946,6 +1946,8 @@ router.post(
           configuration,
         });
       });
+      // set updated_at
+      await table.update({});
       await getState().refresh_tables();
 
       Trigger.emitEvent(
@@ -2072,6 +2074,8 @@ router.post(
     await db.withTransaction(async () => {
       await cons.delete();
     });
+    //set updated_at
+    await Table.findOne(cons.table_id).update({});
     await getState().refresh_tables();
     res.redirect(`/table/constraints/${cons.table_id}`);
   })

package/routes/tenant.js

@@ -43,7 +43,7 @@ const {
 } = require("@saltcorn/markup/tags");
 const db = require("@saltcorn/data/db");
 
-const { loadAllPlugins, loadAndSaveNewPlugin } = require("../load_plugins");
+const Plugin = require("@saltcorn/data/models/plugin");
 const {
   isAdmin,
   error_catcher,
@@ -309,9 +309,9 @@ router.post(
 
         await create_tenant({
           t: subdomain,
-          plugin_loader: loadAllPlugins,
+          plugin_loader: Plugin.loadAllPlugins,
           noSignalOrDB: false,
-          loadAndSaveNewPlugin: loadAndSaveNewPlugin,
+          loadAndSaveNewPlugin: Plugin.loadAndSaveNewPlugin,
           tenant_template,
         });
         let new_url_create = newurl;