@saltcorn/server 1.6.0-beta.6 → 1.6.0-beta.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saltcorn/server",
-  "version": "1.6.0-beta.6",
+  "version": "1.6.0-beta.7",
   "description": "Server app for Saltcorn, open-source no-code platform",
   "homepage": "https://saltcorn.com",
   "main": "index.js",
@@ -9,15 +9,15 @@
     "@aws-sdk/client-s3": "^3.735.0",
     "@aws-sdk/s3-request-presigner": "^3.940.0",
     "@dr.pogodin/csurf": "1.15.0",
-    "@saltcorn/admin-models": "1.6.0-beta.6",
-    "@saltcorn/base-plugin": "1.6.0-beta.6",
-    "@saltcorn/builder": "1.6.0-beta.6",
-    "@saltcorn/workflow-editor": "1.6.0-beta.6",
-    "@saltcorn/data": "1.6.0-beta.6",
-    "@saltcorn/filemanager": "1.6.0-beta.6",
-    "@saltcorn/markup": "1.6.0-beta.6",
-    "@saltcorn/plugins-loader": "1.6.0-beta.6",
-    "@saltcorn/sbadmin2": "1.6.0-beta.6",
+    "@saltcorn/admin-models": "1.6.0-beta.7",
+    "@saltcorn/base-plugin": "1.6.0-beta.7",
+    "@saltcorn/builder": "1.6.0-beta.7",
+    "@saltcorn/workflow-editor": "1.6.0-beta.7",
+    "@saltcorn/data": "1.6.0-beta.7",
+    "@saltcorn/filemanager": "1.6.0-beta.7",
+    "@saltcorn/markup": "1.6.0-beta.7",
+    "@saltcorn/plugins-loader": "1.6.0-beta.7",
+    "@saltcorn/sbadmin2": "1.6.0-beta.7",
     "@socket.io/cluster-adapter": "^0.2.1",
     "@socket.io/sticky": "^1.0.1",
     "adm-zip": "0.5.16",
@@ -70,9 +70,9 @@
     "uuid": "^11.0.5",
     "fs-extra": "^11.3.0",
     "env-paths": "^2.2.1",
-    "@saltcorn/db-common": "1.6.0-beta.6",
+    "@saltcorn/db-common": "1.6.0-beta.7",
     "web-push": "^3.6.7",
-    "@saltcorn/types": "1.6.0-beta.6",
+    "@saltcorn/types": "1.6.0-beta.7",
     "dayjs": "^1.11.13"
   },
   "optionalDependencies": {

package/public/saltcorn.js

@@ -439,8 +439,11 @@ function expand_thumbnail(img_id, filename) {
 
 function ajax_modal(url, opts = {}) {
   $.ajax(url, {
+    ...(opts.method ? { method: opts.method } : {}),
     headers: {
       SaltcornModalRequest: "true",
+      "Page-Load-Tag": _sc_pageloadtag,
+      ...(opts.method === "POST" ? { "CSRF-Token": _sc_globalCsrf } : {}),
     },
     success: function (res, textStatus, request) {
       ensure_modal_exists_and_closed();

package/routes/actions.js

@@ -2435,7 +2435,7 @@ const workflowRunPromiseHandler = (promise, run, req) => {
         ...retDirs,
         page_load_tag: req.headers["page-load-tag"],
       };
-      const userIds = req.user ? undefined : null;
+      const userIds = req.user ? [req.user.id] : null;
       getState().emitDynamicUpdate(db.getTenantSchema(), emitData, userIds);
       if (
         !emitData.resume_workflow &&
@@ -2451,7 +2451,7 @@ const workflowRunPromiseHandler = (promise, run, req) => {
       getState().emitDynamicUpdate(db.getTenantSchema(), {
         error: e.message,
         page_load_tag: req.headers["page-load-tag"],
-      }, req.user ? undefined : null);
+      }, req.user ? [req.user.id] : null);
     });
 };
 

package/routes/api.js

@@ -527,44 +527,47 @@ router.get(
   })
 );
 
-router.get("/:tableName/count", async (req, res, next) => {
-  const { tableName } = req.params;
-  const { approximate, ...req_query } = req.query;
-
-  const table = Table.findOne(
-    strictParseInt(tableName)
-      ? { id: strictParseInt(tableName) }
-      : { name: tableName }
-  );
-  if (!table) {
-    getState().log(3, `API get ${tableName} table not found`);
-    res.status(404).json({ error: req.__("Not found") });
-    return;
-  }
-  await passport.authenticate(
-    ["api-bearer", "jwt"],
-    { session: false },
-    async function (err, user, info) {
-      if (potentiallyAccessAllowedRead(req, user, table)) {
-        const tbl_fields = table.getFields();
-        readState(req_query, tbl_fields, req);
-        const qstate = stateFieldsToWhere({
-          fields: tbl_fields,
-          approximate: !!approximate,
-          state: req_query,
-          table,
-          prefix: "a.",
-          user: req.user || user
-        });
-        const count = await table.countRows(qstate);
-        res.json({ success: count });
-      } else {
-        getState().log(3, `API get ${table.name} not authorized`);
-        res.status(401).json({ error: req.__("Not authorized") });
-      }
+router.get(
+  "/:tableName/count",
+  error_catcher(async (req, res, next) => {
+    const { tableName } = req.params;
+    const { approximate, ...req_query } = req.query;
+
+    const table = Table.findOne(
+      strictParseInt(tableName)
+        ? { id: strictParseInt(tableName) }
+        : { name: tableName }
+    );
+    if (!table) {
+      getState().log(3, `API get ${tableName} table not found`);
+      res.status(404).json({ error: req.__("Not found") });
+      return;
     }
-  )(req, res, next);
-});
+    await passport.authenticate(
+      ["api-bearer", "jwt"],
+      { session: false },
+      async function (err, user, info) {
+        if (potentiallyAccessAllowedRead(req, user, table)) {
+          const tbl_fields = table.getFields();
+          readState(req_query, tbl_fields, req);
+          const qstate = stateFieldsToWhere({
+            fields: tbl_fields,
+            approximate: !!approximate,
+            state: req_query,
+            table,
+            prefix: "a.",
+            user: req.user || user,
+          });
+          const count = await table.countRows(qstate);
+          res.json({ success: count });
+        } else {
+          getState().log(3, `API get ${table.name} not authorized`);
+          res.status(401).json({ error: req.__("Not authorized") });
+        }
+      }
+    )(req, res, next);
+  })
+);
 
 /**
  * Emit Event using POST

package/routes/fields.js

@@ -248,7 +248,20 @@ const fieldFlow = (req) =>
     onDone: async (context) => {
       //const thetype = getState().types[context.type];
       const attributes = context.attributes || {};
-      attributes.default = context.default;
+      // attributes.default = context.default;
+
+      const setDefault =
+        context.set_default === undefined || context.set_default === true;
+      if (setDefault && context.default_type === "expression") {
+        attributes.default_expression = context.default_expression;
+        attributes.default = undefined;
+      } else if (setDefault) {
+        attributes.default = context.default;
+        attributes.default_expression = undefined;
+      } else {
+        attributes.default = undefined;
+        attributes.default_expression = undefined;
+      }
       attributes.summary_field = context.summary_field;
       attributes.include_fts = context.include_fts;
       attributes.on_delete_cascade = context.on_delete_cascade;
@@ -753,10 +766,9 @@ const fieldFlow = (req) =>
           const nrows = await table.countRows();
           const formfield = new Field({
             name: "default",
-            label: req.__("Default"),
-            // todo sublabel
+            label: req.__("Default value"),
             type: context.type,
-            required: true,
+            required: false,
             attributes: {
               summary_field: context.summary_field,
               ...(context.attributes || {}),
@@ -764,7 +776,61 @@ const fieldFlow = (req) =>
           });
           await formfield.fill_fkey_options();
           const defaultOptional = nrows === 0 || context.id;
-          if (defaultOptional) formfield.showIf = { set_default: true };
+          const setDefaultShowIf = defaultOptional
+            ? { set_default: true }
+            : undefined;
+
+          if (setDefaultShowIf)
+            formfield.showIf = {
+              ...setDefaultShowIf,
+              default_type: "fixed",
+            };
+          else formfield.showIf = { default_type: "fixed" };
+
+          const defaultTypeOptions = [
+            { label: req.__("Fixed value"), name: "fixed" },
+            { label: req.__("Expression"), name: "expression" },
+          ];
+
+          const expressionShowIf = setDefaultShowIf
+            ? { ...setDefaultShowIf, default_type: "expression" }
+            : { default_type: "expression" };
+
+          const attrEscape = (s) =>
+            s.replace(/&/g, "&").replace(/"/g, """);
+          const presets = [
+            {
+              label: req.__("Current user ID"),
+              expr: "user && user.id",
+            },
+            {
+              label: req.__("Current user email"),
+              expr: "user && user.email",
+            },
+            {
+              label: req.__("Current timestamp"),
+              expr: "new Date()",
+            },
+            {
+              label: req.__("Current date (ISO)"),
+              expr: "new Date().toISOString().substring(0, 10)",
+            },
+          ];
+          const presetButtons = presets
+            .map(
+              (p) =>
+                `<button type="button" class="btn btn-sm btn-outline-secondary me-1 mb-1" onclick="setDefaultExpressionValue(${attrEscape(JSON.stringify(p.expr))})">${p.label}</button>`
+            )
+            .join("");
+          const setterScript = `<script>
+function setDefaultExpressionValue(val) {
+  var ta = document.querySelector('[name="default_expression"]');
+  if (!ta) return;
+  var monacoDiv = ta.nextElementSibling;
+  var ed = monacoDiv && $(monacoDiv).data && $(monacoDiv).data("monaco-editor");
+  if (ed) { ed.setValue(val); } else { ta.value = val; }
+}
+</script>`;
 
           const form = new Form({
             blurb: defaultOptional
@@ -774,16 +840,53 @@ const fieldFlow = (req) =>
                 ),
             fields: [
               ...(defaultOptional
-                ? [{ name: "set_default", label: "Set Default", type: "Bool" }]
+                ? [
+                    {
+                      name: "set_default",
+                      label: req.__("Set Default"),
+                      type: "Bool",
+                    },
+                  ]
                 : []),
+              {
+                name: "default_type",
+                label: req.__("Default type"),
+                type: "String",
+                attributes: {
+                  options: defaultTypeOptions,
+                },
+                showIf: setDefaultShowIf,
+              },
               formfield,
+              {
+                name: "default_expression",
+                label: req.__("Expression"),
+                sublabel:
+                  req.__(
+                    "JavaScript expression. Available: <code>user</code> (current user). Can be async."
+                  ) +
+                  `<div class="mt-1">${presetButtons}</div>${setterScript}`,
+                input_type: "code",
+                attributes: {
+                  mode: "application/javascript",
+                  user: true,
+                },
+                showIf: expressionShowIf,
+              },
+
             ],
           });
-          if (
+          const hasExprDefault = !!context.default_expression;
+          const hasFixedDefault =
             typeof context.default !== "undefined" &&
-            context.default !== null
-          )
+            context.default !== null &&
+            !hasExprDefault;
+          if (hasExprDefault || hasFixedDefault) {
             form.values.set_default = true;
+            form.values.default_type = hasExprDefault ? "expression" : "fixed";
+          } else {
+            form.values.default_type = "fixed";
+          }
           return form;
         },
       },
@@ -1003,7 +1106,7 @@ router.post(
     try {
       if (stored) {
         const f = get_async_expression_function(formula, fields);
-        result = await f(rows[0]);
+        result = await f(rows[0], req.user);
       } else {
         const f = get_expression_function(formula, fields);
         result = f(rows[0]);

package/routes/list.js

@@ -181,10 +181,11 @@ const typeToGridType = (t, field) => {
       format: "iso",
     };
     jsgField.editor = "__flatpickerEditor";
-    jsgField.formatter = "datetime";
-    jsgField.formatterParams = {
-      inputFormat: "iso",
-    };
+    // jsgField.formatter = "datetime";
+    // jsgField.formatterParams = {
+    //   inputFormat: "iso",
+    // };
+    jsgField.formatter = "__isoDateTimeFormatter";
 
     if (field.attributes?.day_only) {
       jsgField.editorParams = { dayOnly: true };

package/routes/plugins.js

@@ -34,6 +34,8 @@ const {
   plugin_viewtemplates_info_card,
   showRepository,
 } = require("../markup/plugin-store");
+const MarkdownIt = require("markdown-it"),
+  md = new MarkdownIt();
 const {
   h5,
   a,
@@ -56,6 +58,8 @@ const {
   text,
   script,
   domReady,
+  details,
+  summary,
 } = require("@saltcorn/markup/tags");
 const { search_bar } = require("@saltcorn/markup/helpers");
 const fs = require("fs");
@@ -208,6 +212,7 @@ const get_store_items = async (req) => {
       plugin: true,
       description: plugin.description,
       documentation_link: plugin.documentation_link,
+      contents: plugin.contents,
       has_theme: plugin.has_theme,
       has_auth: plugin.has_auth,
       unsafe: plugin.unsafe,
@@ -323,6 +328,9 @@ const store_item_html = (req) => (item) => ({
       item.ready_for_mobile && badge(req.__("Mobile"))
     ),
     div(item.description || ""),
+    item.contents
+      ? details(summary(req.__("Detailed contents")), md.render(item.contents))
+      : "",
     item.documentation_link
       ? div(
           a(
@@ -715,7 +723,8 @@ router.get(
                       label: version,
                       selected: version === selected,
                     })
-                  ).reverse()
+                  )
+                  .reverse()
               ),
               // tag
               label(

package/routes/tables.js

@@ -8,6 +8,7 @@ const Router = require("express-promise-router");
 
 const db = require("@saltcorn/data/db");
 const Table = require("@saltcorn/data/models/table");
+const Field = require("@saltcorn/data/models/field");
 const File = require("@saltcorn/data/models/file");
 const View = require("@saltcorn/data/models/view");
 const User = require("@saltcorn/data/models/user");
@@ -847,6 +848,18 @@ router.get(
     let fieldCard;
     const primaryKeys = fields.filter((f) => f.primary_key);
     const nPrimaryKeys = primaryKeys.length;
+    const standardFieldNames = [
+      "name",
+      "description",
+      "created_at",
+      "updated_at",
+      "created_by",
+      "updated_by",
+    ];
+    const fieldNameSet = new Set(fields.map((f) => f.name));
+    const hasAllStandardFields = standardFieldNames.every((n) =>
+      fieldNameSet.has(n)
+    );
 
     if (fields.length === 0) {
       fieldCard = [
@@ -862,6 +875,17 @@ router.get(
             },
             req.__("Add field to table")
           ),
+        !table.external &&
+          !table.provider_name &&
+          user_can_edit_tables &&
+          !hasAllStandardFields &&
+          a(
+            {
+              class: "btn btn-outline-secondary ms-2",
+              href: `javascript:ajax_modal('/table/create-standard-fields/${table.id}')`,
+            },
+            req.__("Create standard fields")
+          ),
       ];
     } else {
       const tableHtml = mkTable(
@@ -946,6 +970,17 @@ router.get(
             },
             req.__("Add field")
           ),
+        !table.external &&
+          !table.provider_name &&
+          user_can_edit_tables &&
+          !hasAllStandardFields &&
+          a(
+            {
+              class: "btn btn-outline-secondary ms-2 mt-2",
+              href: `javascript:ajax_modal('/table/create-standard-fields/${table.id}')`,
+            },
+            req.__("Create standard fields")
+          ),
       ];
     }
     let viewCard;
@@ -2682,3 +2717,134 @@ router.post(
     res.redirect(`/table/${table.id}`);
   })
 );
+
+const standardFieldDefs = (req) => [
+  {
+    name: "name",
+    label: req.__("Name"),
+    type: "String",
+    fieldType: "String",
+  },
+  {
+    name: "description",
+    label: req.__("Description"),
+    type: "String",
+    fieldType: "String",
+  },
+  {
+    name: "created_at",
+    label: req.__("Created at"),
+    type: "Date",
+    fieldType: "Date",
+    required: true,
+    attributes: { default_expression: "new Date()" },
+  },
+  {
+    name: "updated_at",
+    label: req.__("Updated at"),
+    type: "Date",
+    fieldType: "Date",
+    calculated: true,
+    stored: true,
+    expression: "new Date()",
+  },
+  {
+    name: "created_by",
+    label: req.__("Created by"),
+    type: "Key to user",
+    fieldType: "Key",
+    reftable_name: "users",
+    attributes: { default_expression: "user?.id", summary_field: "email" },
+  },
+  {
+    name: "updated_by",
+    label: req.__("Updated by"),
+    type: "Key to user",
+    fieldType: "Key",
+    reftable_name: "users",
+    calculated: true,
+    stored: true,
+    expression: "user?.id ?? row?.updated_by",
+    attributes: { summary_field: "email" },
+  },
+];
+
+const standardFieldForm = (table, req, existingNames = new Set()) => {
+  const defs = standardFieldDefs(req).filter(
+    (def) => !existingNames.has(def.name)
+  );
+  return new Form({
+    submitLabel: req.__("Create fields"),
+    action: `/table/create-standard-fields/${table.id}`,
+    formStyle: "vert",
+    fields: defs.map((def) => ({
+      type: "Bool",
+      label: `${def.label} (${def.type})`,
+      name: def.name,
+      default: true,
+    })),
+  });
+};
+
+router.get(
+  "/create-standard-fields/:id",
+  isAdminOrHasConfigMinRole("min_role_edit_tables"),
+  error_catcher(async (req, res) => {
+    const { id } = req.params;
+    const table = Table.findOne({ id });
+    if (!table) {
+      req.flash("error", `Table not found`);
+      res.redirect(`/table`);
+      return;
+    }
+    const existingFields = await table.getFields();
+    const existingNames = new Set(existingFields.map((f) => f.name));
+    res.set("Page-Title", req.__("Create standard fields"));
+    const form = standardFieldForm(table, req, existingNames);
+    res.send(renderForm(form, req.csrfToken()));
+  })
+);
+
+router.post(
+  "/create-standard-fields/:id",
+  isAdminOrHasConfigMinRole("min_role_edit_tables"),
+  error_catcher(async (req, res) => {
+    const { id } = req.params;
+    const table = Table.findOne({ id });
+    if (!table) {
+      req.flash("error", `Table not found`);
+      res.redirect(`/table`);
+      return;
+    }
+    const existingFields = await table.getFields();
+    const existingNames = new Set(existingFields.map((f) => f.name));
+    const form = standardFieldForm(table, req, existingNames);
+    form.validate(req.body || {});
+    if (form.hasErrors) {
+      req.flash("error", req.__("An error occurred"));
+      res.redirect(`/table/${table.id}`);
+      return;
+    }
+    const defs = standardFieldDefs(req);
+    await db.withTransaction(async () => {
+      for (const def of defs) {
+        if (!form.values[def.name]) continue;
+        if (existingNames.has(def.name)) continue;
+        await Field.create({
+          table_id: table.id,
+          name: def.name,
+          label: def.label,
+          type: def.fieldType,
+          reftable_name: def.reftable_name,
+          required: def.required || false,
+          calculated: def.calculated || false,
+          stored: def.stored || false,
+          expression: def.expression,
+          attributes: def.attributes || {},
+        });
+      }
+    });
+    await getState().refresh_tables();
+    res.redirect(`/table/${table.id}`);
+  })
+);

package/routes/utils.js

@@ -13,7 +13,11 @@ const {
   features,
 } = require("@saltcorn/data/db/state");
 const { get_base_url } = require("@saltcorn/data/models/config");
-const { hash } = require("@saltcorn/data/utils");
+const {
+  hash,
+  is_relative_url,
+  normalize_relative_url,
+} = require("@saltcorn/data/utils");
 const { input, script, domReady, a, text } = require("@saltcorn/markup/tags");
 const session = require("express-session");
 const cookieSession = require("cookie-session");
@@ -389,36 +393,6 @@ const addOnDoneRedirect = (oldPath, req) => {
   return oldPath;
 };
 
-const is_relative_url = (url) => {
-  if (typeof url !== "string") return false;
-
-  // Normalise backslashes to forward slashes (WHATWG treats \ as / in special schemes)
-  const normalised = url.replace(/\\/g, "/");
-
-  // Reject protocol-relative URLs (//example.com)
-  if (normalised.trimStart().startsWith("//")) return false;
-
-  // Reject any scheme: URIs (e.g. http:, javascript:, data:, vbscript:)
-  // A scheme is a letter followed by letters/digits/+/-/. then a colon (RFC 3986 §3.1)
-  if (/^[a-zA-Z][a-zA-Z0-9+\-.]*:/u.test(normalised.trimStart())) return false;
-
-  return true;
-};
-
-const normalize_relative_url = (url) => {
-  if (typeof url !== "string") return null;
-
-  const normalised = url.replace(/\\/g, "/").trimStart();
-
-  // Reject protocol-relative URLs
-  if (normalised.startsWith("//")) return null;
-
-  // Reject any scheme (RFC 3986 §3.1)
-  if (/^[a-zA-Z][a-zA-Z0-9+\-.]*:/.test(normalised)) return null;
-
-  return normalised;
-};
-
 const safe_redirect = (res, url, default_url) => {
   if (!url) {
     res.redirect(default_url);