@saltcorn/server 1.6.0-beta.5 → 1.6.0-beta.6

package/tests/sync.test.js

@@ -101,7 +101,7 @@ describe("load remote insert/updates", () => {
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
             books: {
-              maxLoadedId: 0,
+              lastModifiedAt: 0,
             },
           },
         });
@@ -111,15 +111,16 @@ describe("load remote insert/updates", () => {
       for (const row of data.books.rows) {
         const fromDb = await books.getRows({ id: row._sync_info_tbl_ref_ });
         expect(fromDb.length).toBe(1);
-        expect(row._sync_info_tbl_last_modified_).toBe(loadUntil.valueOf());
-        expect(row._sync_info_tbl_deleted_).toBe(null);
+        expect(typeof row._sync_info_tbl_last_modified_).toBe("number");
+        expect(row._sync_info_tbl_deleted_).toBe(false);
       }
     });
 
-    it("with syncFrom, without sync_infos", async () => {
+    it("with syncFrom, no changes in window", async () => {
       const app = await getApp({ disableCsrf: true });
       const loginCookie = await getAdminLoginCookie();
       const loadUntil = new Date();
+      // syncFrom == loadUntil → empty time window → no rows
       const resp = await request(app)
         .post("/sync/load_changes")
         .set("Cookie", loginCookie)
@@ -127,8 +128,8 @@ describe("load remote insert/updates", () => {
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
             books: {
-              maxLoadedId: 0,
-              syncFrom: 1000,
+              lastModifiedAt: 0,
+              syncFrom: loadUntil.valueOf(),
             },
           },
         });
@@ -154,7 +155,7 @@ describe("load remote insert/updates", () => {
             loadUntil: (await db.time()).valueOf(),
             syncInfos: {
               books: {
-                maxLoadedId: 0,
+                lastModifiedAt: 0,
                 syncFrom: dbTime.valueOf(),
               },
             },
@@ -169,7 +170,7 @@ describe("load remote insert/updates", () => {
           _sync_info_tbl_deleted_,
           ...rest
         } = data.books.rows[0];
-        expect(_sync_info_tbl_ref_).toBe(2);
+        expect(Number(_sync_info_tbl_ref_)).toBe(2);
         expect(_sync_info_tbl_last_modified_).toBe(last_modified.valueOf());
         expect(_sync_info_tbl_deleted_).toBe(false);
         expect(rest.author).toBe("Leo Tolstoy");
@@ -183,7 +184,7 @@ describe("load remote insert/updates", () => {
             loadUntil: (await db.time()).valueOf(),
             syncInfos: {
               books: {
-                maxLoadedId: 0,
+                lastModifiedAt: 0,
                 syncFrom: dbTime.valueOf(),
               },
             },
@@ -198,13 +199,13 @@ describe("load remote insert/updates", () => {
             _sync_info_tbl_deleted_,
             ...rest
           } = row;
-          expect(_sync_info_tbl_ref_).toBe(rest.id);
+          expect(Number(_sync_info_tbl_ref_)).toBe(rest.id);
           const { last_modified } = await books.latestSyncInfo(rest.id);
           expect(_sync_info_tbl_last_modified_).toBe(last_modified.valueOf());
           expect(_sync_info_tbl_deleted_).toBe(false);
         }
-        expect(data.books.rows[0].author).toBe("Herman Melville");
-        expect(data.books.rows[1].author).toBe("Leo Tolstoy");
+        expect(data.books.rows[0].author).toBe("Leo Tolstoy");
+        expect(data.books.rows[1].author).toBe("Herman Melville");
       }
     });
 
@@ -246,7 +247,7 @@ describe("load remote insert/updates", () => {
           loadUntil: (await db.time()).valueOf(),
           syncInfos: {
             "Table with capitals": {
-              maxLoadedId: 0,
+              lastModifiedAt: 0,
               syncFrom: dbTime.valueOf(),
             },
           },
@@ -265,7 +266,7 @@ describe("load remote insert/updates", () => {
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
             patients: {
-              maxLoadedId: 0,
+              lastModifiedAt: 0,
               syncFrom: 1000,
             },
           },
@@ -304,7 +305,7 @@ describe("load remote insert/updates", () => {
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
             patients: {
-              maxLoadedId: 0,
+              lastModifiedAt: 0,
             },
           },
         });
@@ -334,7 +335,7 @@ describe("load remote insert/updates", () => {
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
             patients: {
-              maxLoadedId: 0,
+              lastModifiedAt: 0,
               syncFrom: 1000,
             },
           },
@@ -913,9 +914,9 @@ describe("SQL injection protection", () => {
       await initSyncInfo(["books"]);
     });
 
-    // --- /sync/load_changes : maxLoadedId ---
+    // --- /sync/load_changes : lastModifiedAt ---
 
-    it("rejects SQL injection in maxLoadedId (OR 1=1)", async () => {
+    it("rejects SQL injection in lastModifiedAt (OR 1=1)", async () => {
       const app = await getApp({ disableCsrf: true });
       const loginCookie = await getAdminLoginCookie();
       await request(app)
@@ -923,14 +924,17 @@ describe("SQL injection protection", () => {
         .set("Cookie", loginCookie)
         .send({
           loadUntil: new Date().valueOf(),
-          syncInfos: { books: { maxLoadedId: "0 OR 1=1--" } },
+          syncInfos: { books: { lastModifiedAt: "0 OR 1=1--" } },
         })
         .expect(
-          respondJsonWith(400, (resp) => resp.error === "Invalid maxLoadedId")
+          respondJsonWith(
+            400,
+            (resp) => resp.error === "Invalid lastModifiedAt"
+          )
         );
     });
 
-    it("rejects SQL injection in maxLoadedId (UNION SELECT)", async () => {
+    it("rejects SQL injection in lastModifiedAt (UNION SELECT)", async () => {
       const app = await getApp({ disableCsrf: true });
       const loginCookie = await getAdminLoginCookie();
       await request(app)
@@ -939,15 +943,18 @@ describe("SQL injection protection", () => {
         .send({
           loadUntil: new Date().valueOf(),
           syncInfos: {
-            books: { maxLoadedId: "0 UNION SELECT * FROM users--" },
+            books: { lastModifiedAt: "0 UNION SELECT * FROM users--" },
           },
         })
         .expect(
-          respondJsonWith(400, (resp) => resp.error === "Invalid maxLoadedId")
+          respondJsonWith(
+            400,
+            (resp) => resp.error === "Invalid lastModifiedAt"
+          )
         );
     });
 
-    it("rejects SQL injection in maxLoadedId (stacked query)", async () => {
+    it("rejects SQL injection in lastModifiedAt (stacked query)", async () => {
       const app = await getApp({ disableCsrf: true });
       const loginCookie = await getAdminLoginCookie();
       await request(app)
@@ -956,15 +963,18 @@ describe("SQL injection protection", () => {
         .send({
           loadUntil: new Date().valueOf(),
           syncInfos: {
-            books: { maxLoadedId: "0; DROP TABLE books; --" },
+            books: { lastModifiedAt: "0; DROP TABLE books; --" },
           },
         })
         .expect(
-          respondJsonWith(400, (resp) => resp.error === "Invalid maxLoadedId")
+          respondJsonWith(
+            400,
+            (resp) => resp.error === "Invalid lastModifiedAt"
+          )
         );
     });
 
-    it("rejects non-numeric string for maxLoadedId", async () => {
+    it("rejects non-numeric string for lastModifiedAt", async () => {
       const app = await getApp({ disableCsrf: true });
       const loginCookie = await getAdminLoginCookie();
       await request(app)
@@ -972,14 +982,17 @@ describe("SQL injection protection", () => {
         .set("Cookie", loginCookie)
         .send({
           loadUntil: new Date().valueOf(),
-          syncInfos: { books: { maxLoadedId: "abc" } },
+          syncInfos: { books: { lastModifiedAt: "abc" } },
         })
         .expect(
-          respondJsonWith(400, (resp) => resp.error === "Invalid maxLoadedId")
+          respondJsonWith(
+            400,
+            (resp) => resp.error === "Invalid lastModifiedAt"
+          )
         );
     });
 
-    it("rejects float maxLoadedId", async () => {
+    it("rejects float lastModifiedAt", async () => {
       const app = await getApp({ disableCsrf: true });
       const loginCookie = await getAdminLoginCookie();
       await request(app)
@@ -987,10 +1000,13 @@ describe("SQL injection protection", () => {
         .set("Cookie", loginCookie)
         .send({
           loadUntil: new Date().valueOf(),
-          syncInfos: { books: { maxLoadedId: 1.5 } },
+          syncInfos: { books: { lastModifiedAt: 1.5 } },
         })
         .expect(
-          respondJsonWith(400, (resp) => resp.error === "Invalid maxLoadedId")
+          respondJsonWith(
+            400,
+            (resp) => resp.error === "Invalid lastModifiedAt"
+          )
         );
     });
 
@@ -1004,7 +1020,7 @@ describe("SQL injection protection", () => {
         .set("Cookie", loginCookie)
         .send({
           loadUntil: new Date().valueOf(),
-          syncInfos: { books: { maxLoadedId: 0, syncFrom: "not-a-date" } },
+          syncInfos: { books: { lastModifiedAt: 0, syncFrom: "not-a-date" } },
         })
         .expect(
           respondJsonWith(400, (resp) => resp.error === "Invalid syncFrom")
@@ -1020,7 +1036,7 @@ describe("SQL injection protection", () => {
         .send({
           loadUntil: new Date().valueOf(),
           syncInfos: {
-            books: { maxLoadedId: 0, syncFrom: "0); SELECT pg_sleep(5)--" },
+            books: { lastModifiedAt: 0, syncFrom: "0); SELECT pg_sleep(5)--" },
           },
         })
         .expect(
@@ -1038,7 +1054,7 @@ describe("SQL injection protection", () => {
         .set("Cookie", loginCookie)
         .send({
           loadUntil: "not-a-date",
-          syncInfos: { books: { maxLoadedId: 0 } },
+          syncInfos: { books: { lastModifiedAt: 0 } },
         })
         .expect(
           respondJsonWith(400, (resp) => resp.error === "Invalid syncUntil")
@@ -1113,7 +1129,7 @@ describe("SQL injection protection", () => {
 
     // --- regression: valid requests still succeed ---
 
-    it("valid maxLoadedId integer still works", async () => {
+    it("valid lastModifiedAt value still works", async () => {
       const app = await getApp({ disableCsrf: true });
       const loginCookie = await getAdminLoginCookie();
       const resp = await request(app)
@@ -1121,7 +1137,7 @@ describe("SQL injection protection", () => {
         .set("Cookie", loginCookie)
         .send({
           loadUntil: new Date().valueOf(),
-          syncInfos: { books: { maxLoadedId: 0 } },
+          syncInfos: { books: { lastModifiedAt: 0 } },
         });
       expect(resp.status).toBe(200);
       expect(resp._body.books).toBeDefined();
@@ -1135,7 +1151,7 @@ describe("SQL injection protection", () => {
         .set("Cookie", loginCookie)
         .send({
           loadUntil: new Date().valueOf(),
-          syncInfos: { books: { maxLoadedId: 0, syncFrom: 1000 } },
+          syncInfos: { books: { lastModifiedAt: 0, syncFrom: 1000 } },
         });
       expect(resp.status).toBe(200);
     });
@@ -1322,7 +1338,7 @@ describe("deletes authorization with ownership_formula", () => {
       expect(resp.status).toBe(200);
       const deletes = resp._body.deletes?.sync_owned || [];
       expect(deletes.length).toBe(1);
-      expect(deletes[0].ref).toBe(itemId);
+      expect(Number(deletes[0].ref)).toBe(itemId);
     });
 
     it("direct formula: non-owner does not see deleted rows", async () => {
@@ -1373,7 +1389,7 @@ describe("deletes authorization with ownership_formula", () => {
       expect(resp.status).toBe(200);
       const deletes = resp._body.deletes?.sync_child || [];
       expect(deletes.length).toBe(1);
-      expect(deletes[0].ref).toBe(childId);
+      expect(Number(deletes[0].ref)).toBe(childId);
     });
 
     it("join formula: non-owner does not see deleted child rows", async () => {
@@ -1613,7 +1629,7 @@ describe("load_changes authorization with ownership_formula", () => {
         .send({
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
-            lc_owned: { maxLoadedId: 0 },
+            lc_owned: { lastModifiedAt: 0 },
           },
         });
       expect(resp.status).toBe(200);
@@ -1635,7 +1651,7 @@ describe("load_changes authorization with ownership_formula", () => {
         .send({
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
-            lc_owned: { maxLoadedId: 0 },
+            lc_owned: { lastModifiedAt: 0 },
           },
         });
       expect(resp.status).toBe(200);
@@ -1661,7 +1677,7 @@ describe("load_changes authorization with ownership_formula", () => {
         .send({
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
-            lc_child: { maxLoadedId: 0 },
+            lc_child: { lastModifiedAt: 0 },
           },
         });
       expect(resp.status).toBe(200);
@@ -1687,7 +1703,7 @@ describe("load_changes authorization with ownership_formula", () => {
         .send({
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
-            lc_child: { maxLoadedId: 0 },
+            lc_child: { lastModifiedAt: 0 },
           },
         });
       expect(resp.status).toBe(200);
@@ -1712,7 +1728,7 @@ describe("load_changes authorization with ownership_formula", () => {
         .send({
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
-            lc_owned: { maxLoadedId: 0, syncFrom: syncFrom.valueOf() },
+            lc_owned: { lastModifiedAt: 0, syncFrom: syncFrom.valueOf() },
           },
         });
       expect(resp.status).toBe(200);
@@ -1737,7 +1753,7 @@ describe("load_changes authorization with ownership_formula", () => {
         .send({
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
-            lc_owned: { maxLoadedId: 0, syncFrom: syncFrom.valueOf() },
+            lc_owned: { lastModifiedAt: 0, syncFrom: syncFrom.valueOf() },
           },
         });
       expect(resp.status).toBe(200);

package/wrapper.js

@@ -175,7 +175,7 @@ const get_headers = (req, version_tag, description, extras = []) => {
   }
   from_cfg.push({
     scriptBody: `var dynamic_updates_cfg = ${JSON.stringify({
-      enabled: dynamic_updates_enabled && req.user?.id,
+      enabled: dynamic_updates_enabled
     })}`,
   });
   return [

package/docs/functions/_saltcorn_data.migrations_202604111200.sql_pg.html

@@ -1 +0,0 @@
-<!DOCTYPE html><html class="default" lang="en" data-base="../"><head><meta charset="utf-8"/><meta http-equiv="x-ua-compatible" content="IE=edge"/><title>sql_pg | Documentation</title><meta name="description" content="Documentation for Documentation"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="stylesheet" href="../assets/style.css"/><link rel="stylesheet" href="../assets/highlight.css"/><link rel="stylesheet" href="../assets/custom.css"/><script defer src="../assets/main.js"></script><script async src="../assets/icons.js" id="tsd-icons-script"></script><script async src="../assets/search.js" id="tsd-search-script"></script><script async src="../assets/navigation.js" id="tsd-nav-script"></script><script async src="../assets/hierarchy.js" id="tsd-hierarchy-script"></script></head><body><script>document.documentElement.dataset.theme = localStorage.getItem("tsd-theme") || "os";document.body.style.display="none";setTimeout(() => window.app?app.showPage():document.body.style.removeProperty("display"),500)</script><header class="tsd-page-toolbar"><div class="tsd-toolbar-contents container"><a href="../index.html" class="title">Documentation</a><div id="tsd-toolbar-links"></div><button id="tsd-search-trigger" class="tsd-widget" aria-label="Search"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><use href="../assets/icons.svg#icon-search"></use></svg></button><dialog id="tsd-search" aria-label="Search"><input role="combobox" id="tsd-search-input" aria-controls="tsd-search-results" aria-autocomplete="list" aria-expanded="true" autocapitalize="off" autocomplete="off" placeholder="Search the docs" maxLength="100"/><ul role="listbox" id="tsd-search-results"></ul><div id="tsd-search-status" aria-live="polite" aria-atomic="true"><div>Preparing search index...</div></div></dialog><a href="#" class="tsd-widget menu" id="tsd-toolbar-menu-trigger" data-toggle="menu" aria-label="Menu"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><use href="../assets/icons.svg#icon-menu"></use></svg></a></div></header><div class="container container-main"><div class="col-content"><div class="tsd-page-title"><ul class="tsd-breadcrumb" aria-label="Breadcrumb"><li><a href="../modules/_saltcorn_data.html">@saltcorn/data</a></li><li><a href="../modules/_saltcorn_data.migrations_202604111200.html">migrations/202604111200</a></li><li><a href="" aria-current="page">sql_pg</a></li></ul><h1>Function sql_pg</h1></div><section class="tsd-panel"><ul class="tsd-signatures"><li class=""><div class="tsd-signature tsd-anchor-link" id="sql_pg"><span class="tsd-kind-call-signature">sql_pg</span><span class="tsd-signature-symbol">(</span><span class="tsd-kind-parameter">__namedParameters</span><span class="tsd-signature-symbol">:</span> <span class="tsd-signature-symbol">{</span> <span class="tsd-kind-property">schema</span><span class="tsd-signature-symbol">:</span> <span class="tsd-signature-type">any</span> <span class="tsd-signature-symbol">}</span><span class="tsd-signature-symbol">)</span><span class="tsd-signature-symbol">:</span> <span class="tsd-signature-type">string</span><a href="#sql_pg" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="../assets/icons.svg#icon-anchor"></use></svg></a></div><div class="tsd-description"><div class="tsd-parameters"><h4 class="tsd-parameters-title">Parameters</h4><ul class="tsd-parameter-list"><li><span><span class="tsd-kind-parameter">__namedParameters</span>: <span class="tsd-signature-symbol">{</span> <span class="tsd-kind-property">schema</span><span class="tsd-signature-symbol">:</span> <span class="tsd-signature-type">any</span> <span class="tsd-signature-symbol">}</span></span></li></ul></div><h4 class="tsd-returns-title">Returns <span class="tsd-signature-type">string</span></h4><aside class="tsd-sources"><ul><li>Defined in <a href="https://github.com/saltcorn/saltcorn/blob/5ffb259a57b659092b49fefd009a9531667a2c1b/packages/saltcorn-data/migrations/202604111200.js#L1">saltcorn-data/migrations/202604111200.js:1</a></li></ul></aside></div></li></ul></section></div><div class="col-sidebar"><div class="page-menu"><div class="tsd-navigation settings"><details class="tsd-accordion"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="../assets/icons.svg#icon-chevronDown"></use></svg><h3>Settings</h3></summary><div class="tsd-accordion-details"><div class="tsd-filter-visibility"><span class="settings-label">Member Visibility</span><ul id="tsd-filter-options"><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-protected" name="protected"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Protected</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-inherited" name="inherited" checked/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Inherited</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-external" name="external"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>External</span></label></li></ul></div><div class="tsd-theme-toggle"><label class="settings-label" for="tsd-theme">Theme</label><select id="tsd-theme"><option value="os">OS</option><option value="light">Light</option><option value="dark">Dark</option></select></div></div></details></div></div><div class="site-menu"><nav class="tsd-navigation"><a href="../modules.html">Documentation</a><ul class="tsd-small-nested-navigation" id="tsd-nav-container"><li>Loading...</li></ul></nav></div></div></div><footer><p class="tsd-generator">Generated using <a href="https://typedoc.org/" target="_blank">TypeDoc</a></p></footer><div class="overlay"></div></body></html>