@saltcorn/server 1.6.0-beta.5 → 1.6.0-beta.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saltcorn/server",
-  "version": "1.6.0-beta.5",
+  "version": "1.6.0-beta.7",
   "description": "Server app for Saltcorn, open-source no-code platform",
   "homepage": "https://saltcorn.com",
   "main": "index.js",
@@ -9,15 +9,15 @@
     "@aws-sdk/client-s3": "^3.735.0",
     "@aws-sdk/s3-request-presigner": "^3.940.0",
     "@dr.pogodin/csurf": "1.15.0",
-    "@saltcorn/admin-models": "1.6.0-beta.5",
-    "@saltcorn/base-plugin": "1.6.0-beta.5",
-    "@saltcorn/builder": "1.6.0-beta.5",
-    "@saltcorn/workflow-editor": "1.6.0-beta.5",
-    "@saltcorn/data": "1.6.0-beta.5",
-    "@saltcorn/filemanager": "1.6.0-beta.5",
-    "@saltcorn/markup": "1.6.0-beta.5",
-    "@saltcorn/plugins-loader": "1.6.0-beta.5",
-    "@saltcorn/sbadmin2": "1.6.0-beta.5",
+    "@saltcorn/admin-models": "1.6.0-beta.7",
+    "@saltcorn/base-plugin": "1.6.0-beta.7",
+    "@saltcorn/builder": "1.6.0-beta.7",
+    "@saltcorn/workflow-editor": "1.6.0-beta.7",
+    "@saltcorn/data": "1.6.0-beta.7",
+    "@saltcorn/filemanager": "1.6.0-beta.7",
+    "@saltcorn/markup": "1.6.0-beta.7",
+    "@saltcorn/plugins-loader": "1.6.0-beta.7",
+    "@saltcorn/sbadmin2": "1.6.0-beta.7",
     "@socket.io/cluster-adapter": "^0.2.1",
     "@socket.io/sticky": "^1.0.1",
     "adm-zip": "0.5.16",
@@ -31,7 +31,7 @@
     "cors": "2.8.5",
     "csv-stringify": "^6.5.2",
     "csvtojson": "^2.0.10",
-    "dompurify": "3.2.6",
+    "dompurify": "3.4.0",
     "express": "^5.0.1",
     "express-fileupload": "^1.5.1",
     "express-promise-router": "^3.0.3",
@@ -70,9 +70,9 @@
     "uuid": "^11.0.5",
     "fs-extra": "^11.3.0",
     "env-paths": "^2.2.1",
-    "@saltcorn/db-common": "1.6.0-beta.5",
+    "@saltcorn/db-common": "1.6.0-beta.7",
     "web-push": "^3.6.7",
-    "@saltcorn/types": "1.6.0-beta.5",
+    "@saltcorn/types": "1.6.0-beta.7",
     "dayjs": "^1.11.13"
   },
   "optionalDependencies": {

package/public/saltcorn-common.js

@@ -280,7 +280,7 @@ function apply_showif() {
       } else {
         e.append(
           $(
-            `<option ${
+            `<option ${o.disabled? "disabled ":""}${
               `${current}` === `${o.value}` ? "selected" : ""
             } value="${o.value}">${o.label}</option>`
           )
@@ -2114,13 +2114,16 @@ function enable_monaco(codes, f) {
   const hasUser = codes
     .find((c) => c.getAttribute("user"))
     ?.getAttribute?.("user");
+  const nojoins = codes
+    .find((c) => c.getAttribute("nojoins"))
+    ?.getAttribute?.("nojoins");
   const isWorkflow = codes
     .find((c) => c.getAttribute("workflow"))
     ?.getAttribute?.("workflow");
   const codepage = $(textarea).attr("codepage");
 
   $.ajax({
-    url: `/admin/ts-declares?${tableName ? `table=${tableName}` : ""}&${hasUser ? `user=${hasUser}` : ""}&${codepage ? `codepage=${codepage}` : ""}&${isWorkflow ? `workflow=${isWorkflow}` : ""}`,
+    url: `/admin/ts-declares?${tableName ? `table=${tableName}` : ""}&${hasUser ? `user=${hasUser}` : ""}&${codepage ? `codepage=${codepage}` : ""}&${isWorkflow ? `workflow=${isWorkflow}` : ""}&${nojoins ? `nojoins=${nojoins}` : ""}`,
     success: (ds) => {
       $.ajax({
         url: `/static_assets/${_sc_version_tag}/monaco/loader.js`,

package/public/saltcorn.js

@@ -439,8 +439,11 @@ function expand_thumbnail(img_id, filename) {
 
 function ajax_modal(url, opts = {}) {
   $.ajax(url, {
+    ...(opts.method ? { method: opts.method } : {}),
     headers: {
       SaltcornModalRequest: "true",
+      "Page-Load-Tag": _sc_pageloadtag,
+      ...(opts.method === "POST" ? { "CSRF-Token": _sc_globalCsrf } : {}),
     },
     success: function (res, textStatus, request) {
       ensure_modal_exists_and_closed();
@@ -1136,6 +1139,26 @@ function build_mobile_app(button) {
     (option) => option.value
   );
 
+  ajax_post("/admin/build-mobile-app/validate-synced-tables", {
+    data: { synchedTables: params.synchedTables },
+    success: (data) => {
+      if (
+        data.warnings &&
+        data.warnings.length > 0 &&
+        !confirm(
+          "Warning: some tables referenced by synced tables are not synced:\n\n" +
+            data.warnings.join("\n") +
+            "\n\nDo you really want to continue?"
+        )
+      ) {
+        return;
+      }
+      _do_build_mobile_app(button, params);
+    },
+  });
+}
+
+function _do_build_mobile_app(button, params) {
   if (
     params.useDocker &&
     !window.capacitorBuilderAvailable &&

package/routes/actions.js

@@ -2393,9 +2393,9 @@ router.get(
   error_catcher(async (req, res) => {
     const { id } = req.params;
 
-    const run = await WorkflowRun.findOne({ id });
+    const run = await WorkflowRun.findOne({ id: +id });
 
-    if (!run.user_allowed_to_fill_form(req.user)) {
+    if (!run || !run.user_allowed_to_fill_form(req.user)) {
       if (req.xhr) res.json({ error: "Not authorized" });
       else {
         req.flash("danger", req.__("Not authorized"));
@@ -2435,7 +2435,8 @@ const workflowRunPromiseHandler = (promise, run, req) => {
         ...retDirs,
         page_load_tag: req.headers["page-load-tag"],
       };
-      getState().emitDynamicUpdate(db.getTenantSchema(), emitData);
+      const userIds = req.user ? [req.user.id] : null;
+      getState().emitDynamicUpdate(db.getTenantSchema(), emitData, userIds);
       if (
         !emitData.resume_workflow &&
         !emitData.popup?.startsWith?.("/actions/fill-workflow-form/")
@@ -2443,14 +2444,14 @@ const workflowRunPromiseHandler = (promise, run, req) => {
         getState().emitDynamicUpdate(db.getTenantSchema(), {
           eval_js: "reset_spinners()",
           page_load_tag: req.headers["page-load-tag"],
-        });
+        }, userIds);
     })
     .catch((e) => {
       console.error(e);
       getState().emitDynamicUpdate(db.getTenantSchema(), {
         error: e.message,
         page_load_tag: req.headers["page-load-tag"],
-      });
+      }, req.user ? [req.user.id] : null);
     });
 };
 
@@ -2460,7 +2461,7 @@ router.post(
     const { id } = req.params;
 
     const run = await WorkflowRun.findOne({ id });
-    if (!run.user_allowed_to_fill_form(req.user)) {
+    if (!run || !run.user_allowed_to_fill_form(req.user)) {
       if (req.xhr) res.json({ error: "Not authorized" });
       else {
         req.flash("danger", req.__("Not authorized"));
@@ -2518,9 +2519,9 @@ router.post(
   error_catcher(async (req, res) => {
     const { id } = req.params;
 
-    const run = await WorkflowRun.findOne({ id });
+    const run = await WorkflowRun.findOne({ id: +id });
     //TODO session if not logged in
-    if (run.started_by !== req.user?.id) {
+    if (!run || run.started_by !== req.user?.id) {
       if (req.xhr) res.json({ error: "Not authorized" });
       else {
         req.flash("danger", req.__("Not authorized"));

package/routes/admin.js

@@ -907,7 +907,12 @@ router.get(
   ]),
   error_catcher(async (req, res) => {
     const { type, name } = req.params;
-    const snaps = await Snapshot.entity_history(type, name);
+    const snapOffset = parseInt(req.query.snap_offset) || 0;
+    const { history: snaps, hasMore } = await Snapshot.entity_history(
+      type,
+      name,
+      snapOffset
+    );
     const locale = getState().getConfig("default_locale", "en");
     const auth = checkEditPermission(type + "s", req.user);
     if (!auth) {
@@ -915,6 +920,9 @@ router.get(
       return;
     }
     res.set("Page-Title", `Restore ${text(name)}`);
+    let olderUrl = `/admin/snapshot-restore/${type}/${encodeURIComponent(name)}?snap_offset=${snapOffset + 100}`;
+    if (req.query.on_done_redirect)
+      olderUrl += `&on_done_redirect=${encodeURIComponent(req.query.on_done_redirect)}`;
     res.send(
       mkTable(
         [
@@ -945,7 +953,10 @@ router.get(
           },
         ],
         snaps
-      )
+      ) +
+        (hasMore
+          ? `<div class="mt-2 text-center"><button class="btn btn-secondary btn-sm" onclick="ajax_modal('${olderUrl}')">${req.__("Load older snapshots")}</button></div>`
+          : "")
     );
   })
 );
@@ -2027,9 +2038,7 @@ router.post(
   error_catcher(async (req, res) => {
     const newPath = File.get_new_path();
     await req.files.file.mv(newPath);
-    const err = await restore(newPath, (p) =>
-      Plugin.loadAndSaveNewPlugin(p)
-    );
+    const err = await restore(newPath, (p) => Plugin.loadAndSaveNewPlugin(p));
     if (err) req.flash("error", err);
     else req.flash("success", req.__("Successfully restored backup"));
     await getState().refresh_plugins();
@@ -4548,6 +4557,54 @@ router.post(
   })
 );
 
+/**
+ * Validate synced tables: check that all tables reachable via FK from the
+ * selected synced tables are also included in the synced set.
+ */
+router.post(
+  "/build-mobile-app/validate-synced-tables",
+  isAdmin,
+  error_catcher(async (req, res) => {
+    const { synchedTables } = req.body || {};
+    if (!Array.isArray(synchedTables) || synchedTables.length === 0) {
+      return res.json({ warnings: [] });
+    }
+
+    const syncedSet = new Set(synchedTables);
+    const visited = new Set();
+    const queue = [...synchedTables];
+    const missing = new Set();
+
+    while (queue.length > 0) {
+      const tblName = queue.shift();
+      if (visited.has(tblName)) continue;
+      visited.add(tblName);
+
+      const table = Table.findOne({ name: tblName });
+      if (!table) continue;
+
+      for (const field of table.getFields()) {
+        if (field.reftable_name && !field.calculated) {
+          const refName = field.reftable_name;
+          if (refName === "users") continue;
+          if (!syncedSet.has(refName)) {
+            missing.add(refName);
+          }
+          if (!visited.has(refName)) {
+            queue.push(refName);
+          }
+        }
+      }
+    }
+
+    const warnings = [...missing].map(
+      (tblName) =>
+        `Table "${tblName}" is referenced by a synced table but is not itself synced.`
+    );
+    res.json({ warnings });
+  })
+);
+
 /**
  * Do Build Mobile App
  */
@@ -5252,7 +5309,8 @@ router.get(
 declare var console: Console;
 function setTimeout(f:Function, timeout?:number)
 declare const page_load_tag: string
-function emit_to_client(message: object, to_user_ids?: number | number[])
+function emit_to_client(message: object, to_user_ids?: number | number[] | null)
+function emitEvent(eventType: ${Trigger.when_options.map(o=>`"${o}"`).join(" | ")}, channel?: string, payload?: any)
 async function sleep(milliseconds: number)
 function interpolate(s: string,
   row: Row,
@@ -5363,7 +5421,7 @@ async function refreshSystemCache(entities?: "codepages" | "tables" | "views" |
             }
           });
         };
-        addTsFields(table, "", 2);
+        addTsFields(table, "", req.query.nojoins ? -1 : 2);
         ds.push(`declare const table: Table`);
         ds.push(`declare const row: {
          ${tsFields.join("\n")}
@@ -5631,7 +5689,8 @@ router.post(
       //ignore
     }
     try {
-      res.json({ success: true, code: stripTypes(`async () =>{${code}}`) });
+      res.json({ success: true, code: stripTypes(`async () =>{${code}
+}`) });
     } catch (error) {
       res.json({ success: false, error: error.message });
     }

package/routes/api.js

@@ -527,44 +527,47 @@ router.get(
   })
 );
 
-router.get("/:tableName/count", async (req, res, next) => {
-  const { tableName } = req.params;
-  const { approximate, ...req_query } = req.query;
-
-  const table = Table.findOne(
-    strictParseInt(tableName)
-      ? { id: strictParseInt(tableName) }
-      : { name: tableName }
-  );
-  if (!table) {
-    getState().log(3, `API get ${tableName} table not found`);
-    res.status(404).json({ error: req.__("Not found") });
-    return;
-  }
-  await passport.authenticate(
-    ["api-bearer", "jwt"],
-    { session: false },
-    async function (err, user, info) {
-      if (potentiallyAccessAllowedRead(req, user, table)) {
-        const tbl_fields = table.getFields();
-        readState(req_query, tbl_fields, req);
-        const qstate = stateFieldsToWhere({
-          fields: tbl_fields,
-          approximate: !!approximate,
-          state: req_query,
-          table,
-          prefix: "a.",
-          user: req.user || user
-        });
-        const count = await table.countRows(qstate);
-        res.json({ success: count });
-      } else {
-        getState().log(3, `API get ${table.name} not authorized`);
-        res.status(401).json({ error: req.__("Not authorized") });
-      }
+router.get(
+  "/:tableName/count",
+  error_catcher(async (req, res, next) => {
+    const { tableName } = req.params;
+    const { approximate, ...req_query } = req.query;
+
+    const table = Table.findOne(
+      strictParseInt(tableName)
+        ? { id: strictParseInt(tableName) }
+        : { name: tableName }
+    );
+    if (!table) {
+      getState().log(3, `API get ${tableName} table not found`);
+      res.status(404).json({ error: req.__("Not found") });
+      return;
     }
-  )(req, res, next);
-});
+    await passport.authenticate(
+      ["api-bearer", "jwt"],
+      { session: false },
+      async function (err, user, info) {
+        if (potentiallyAccessAllowedRead(req, user, table)) {
+          const tbl_fields = table.getFields();
+          readState(req_query, tbl_fields, req);
+          const qstate = stateFieldsToWhere({
+            fields: tbl_fields,
+            approximate: !!approximate,
+            state: req_query,
+            table,
+            prefix: "a.",
+            user: req.user || user,
+          });
+          const count = await table.countRows(qstate);
+          res.json({ success: count });
+        } else {
+          getState().log(3, `API get ${table.name} not authorized`);
+          res.status(401).json({ error: req.__("Not authorized") });
+        }
+      }
+    )(req, res, next);
+  })
+);
 
 /**
  * Emit Event using POST

package/routes/fields.js

@@ -248,7 +248,20 @@ const fieldFlow = (req) =>
     onDone: async (context) => {
       //const thetype = getState().types[context.type];
       const attributes = context.attributes || {};
-      attributes.default = context.default;
+      // attributes.default = context.default;
+
+      const setDefault =
+        context.set_default === undefined || context.set_default === true;
+      if (setDefault && context.default_type === "expression") {
+        attributes.default_expression = context.default_expression;
+        attributes.default = undefined;
+      } else if (setDefault) {
+        attributes.default = context.default;
+        attributes.default_expression = undefined;
+      } else {
+        attributes.default = undefined;
+        attributes.default_expression = undefined;
+      }
       attributes.summary_field = context.summary_field;
       attributes.include_fts = context.include_fts;
       attributes.on_delete_cascade = context.on_delete_cascade;
@@ -753,10 +766,9 @@ const fieldFlow = (req) =>
           const nrows = await table.countRows();
           const formfield = new Field({
             name: "default",
-            label: req.__("Default"),
-            // todo sublabel
+            label: req.__("Default value"),
             type: context.type,
-            required: true,
+            required: false,
             attributes: {
               summary_field: context.summary_field,
               ...(context.attributes || {}),
@@ -764,7 +776,61 @@ const fieldFlow = (req) =>
           });
           await formfield.fill_fkey_options();
           const defaultOptional = nrows === 0 || context.id;
-          if (defaultOptional) formfield.showIf = { set_default: true };
+          const setDefaultShowIf = defaultOptional
+            ? { set_default: true }
+            : undefined;
+
+          if (setDefaultShowIf)
+            formfield.showIf = {
+              ...setDefaultShowIf,
+              default_type: "fixed",
+            };
+          else formfield.showIf = { default_type: "fixed" };
+
+          const defaultTypeOptions = [
+            { label: req.__("Fixed value"), name: "fixed" },
+            { label: req.__("Expression"), name: "expression" },
+          ];
+
+          const expressionShowIf = setDefaultShowIf
+            ? { ...setDefaultShowIf, default_type: "expression" }
+            : { default_type: "expression" };
+
+          const attrEscape = (s) =>
+            s.replace(/&/g, "&").replace(/"/g, """);
+          const presets = [
+            {
+              label: req.__("Current user ID"),
+              expr: "user && user.id",
+            },
+            {
+              label: req.__("Current user email"),
+              expr: "user && user.email",
+            },
+            {
+              label: req.__("Current timestamp"),
+              expr: "new Date()",
+            },
+            {
+              label: req.__("Current date (ISO)"),
+              expr: "new Date().toISOString().substring(0, 10)",
+            },
+          ];
+          const presetButtons = presets
+            .map(
+              (p) =>
+                `<button type="button" class="btn btn-sm btn-outline-secondary me-1 mb-1" onclick="setDefaultExpressionValue(${attrEscape(JSON.stringify(p.expr))})">${p.label}</button>`
+            )
+            .join("");
+          const setterScript = `<script>
+function setDefaultExpressionValue(val) {
+  var ta = document.querySelector('[name="default_expression"]');
+  if (!ta) return;
+  var monacoDiv = ta.nextElementSibling;
+  var ed = monacoDiv && $(monacoDiv).data && $(monacoDiv).data("monaco-editor");
+  if (ed) { ed.setValue(val); } else { ta.value = val; }
+}
+</script>`;
 
           const form = new Form({
             blurb: defaultOptional
@@ -774,16 +840,53 @@ const fieldFlow = (req) =>
                 ),
             fields: [
               ...(defaultOptional
-                ? [{ name: "set_default", label: "Set Default", type: "Bool" }]
+                ? [
+                    {
+                      name: "set_default",
+                      label: req.__("Set Default"),
+                      type: "Bool",
+                    },
+                  ]
                 : []),
+              {
+                name: "default_type",
+                label: req.__("Default type"),
+                type: "String",
+                attributes: {
+                  options: defaultTypeOptions,
+                },
+                showIf: setDefaultShowIf,
+              },
               formfield,
+              {
+                name: "default_expression",
+                label: req.__("Expression"),
+                sublabel:
+                  req.__(
+                    "JavaScript expression. Available: <code>user</code> (current user). Can be async."
+                  ) +
+                  `<div class="mt-1">${presetButtons}</div>${setterScript}`,
+                input_type: "code",
+                attributes: {
+                  mode: "application/javascript",
+                  user: true,
+                },
+                showIf: expressionShowIf,
+              },
+
             ],
           });
-          if (
+          const hasExprDefault = !!context.default_expression;
+          const hasFixedDefault =
             typeof context.default !== "undefined" &&
-            context.default !== null
-          )
+            context.default !== null &&
+            !hasExprDefault;
+          if (hasExprDefault || hasFixedDefault) {
             form.values.set_default = true;
+            form.values.default_type = hasExprDefault ? "expression" : "fixed";
+          } else {
+            form.values.default_type = "fixed";
+          }
           return form;
         },
       },
@@ -1003,7 +1106,7 @@ router.post(
     try {
       if (stored) {
         const f = get_async_expression_function(formula, fields);
-        result = await f(rows[0]);
+        result = await f(rows[0], req.user);
       } else {
         const f = get_expression_function(formula, fields);
         result = f(rows[0]);
@@ -1348,6 +1451,7 @@ router.post(
         undefined,
         req.user
       );
+    if (fv?.fill_options) await fv.fill_options(field);
     if (!fv && field.type === "Key" && fieldview === "select")
       res.send(
         `<input ${

package/routes/files.js

@@ -183,10 +183,11 @@ router.get(
       file.location = file.isDirectory ? file.path_to_serve : file.field_value;
     }
     if (file_exts) {
+      const escapeRegex = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
       const re = new RegExp(
         `\\.(${file_exts
           .split(",")
-          .map((s) => s.trim())
+          .map((s) => escapeRegex(s.trim()))
           .join("|")})$`,
         "i"
       );
@@ -487,6 +488,17 @@ router.get(
       const width = strictParseInt(width_str);
       const height =
         height_str && height_str !== "0" ? strictParseInt(height_str) : null;
+      if (
+        file.mimetype === "image/svg+xml" ||
+        file.mimetype === "application/mathml+xml"
+      ) {
+        const window = new JSDOM("").window;
+        const DOMPurify = createDOMPurify(window);
+        const contents = await fs.promises.readFile(file.location);
+        const clean = DOMPurify.sanitize(contents);
+        res.send(clean);
+        return;
+      }
       if (!width) {
         res.sendFile(file.location, { dotfiles: "allow" });
         return;

package/routes/list.js

@@ -181,10 +181,11 @@ const typeToGridType = (t, field) => {
       format: "iso",
     };
     jsgField.editor = "__flatpickerEditor";
-    jsgField.formatter = "datetime";
-    jsgField.formatterParams = {
-      inputFormat: "iso",
-    };
+    // jsgField.formatter = "datetime";
+    // jsgField.formatterParams = {
+    //   inputFormat: "iso",
+    // };
+    jsgField.formatter = "__isoDateTimeFormatter";
 
     if (field.attributes?.day_only) {
       jsgField.editorParams = { dayOnly: true };