@saltcorn/server 1.6.0-beta.8 → 1.6.0-rc.1

package/routes/tables.js

@@ -64,6 +64,9 @@ const {
   discoverable_tables,
   discover_tables,
   implement_discovery,
+  reconcile_table,
+  make_field,
+  findType,
 } = require("@saltcorn/data/models/discovery");
 const { getState } = require("@saltcorn/data/db/state");
 const { cardHeaderTabs } = require("@saltcorn/markup/layout_utils");
@@ -793,6 +796,342 @@ const attribBadges = (f) => {
   return s;
 };
 
+/**
+ * Rescan Table Fields (GET Handler)
+ * @name get/rescan/:idorname
+ * @function
+ * @memberof module:routes/tables~tablesRouter
+ */
+router.get(
+  "/rescan/:idorname",
+  isAdmin,
+  error_catcher(async (req, res) => {
+    const { idorname } = req.params;
+    let id = parseInt(idorname);
+    let table;
+    if (id) [table] = await Table.find({ id });
+    if (!table) [table] = await Table.find({ name: idorname });
+    if (!table) {
+      req.flash("error", req.__(`Table not found`));
+      res.redirect(`/table`);
+      return;
+    }
+
+    const result = await reconcile_table(table);
+    const ghosts = result.fields.filter((f) => f.status === "ghost");
+    const orphans = result.fields.filter((f) => f.status === "orphan");
+    const matches = result.fields.filter((f) => f.status === "match");
+
+    const statusBadge = (status) => {
+      switch (status) {
+        case "match":
+          return badge("success", req.__("Match"));
+        case "ghost":
+          return badge("danger", req.__("Ghost"));
+        case "orphan":
+          return badge("primary", req.__("Orphan"));
+        default:
+          return "";
+      }
+    };
+
+    let ghostForm = "";
+    if (ghosts.length > 0) {
+      ghostForm = form(
+        {
+          method: "post",
+          action: `/table/rescan-delete/${table.id}`,
+        },
+        input({ type: "hidden", name: "_csrf", value: req.csrfToken() }),
+        h4(
+          { class: "text-danger" },
+          req.__("Ghost fields (in Saltcorn, not in DB)")
+        ),
+        mkTable(
+          [
+            {
+              label: "",
+              key: (r) =>
+                input({
+                  type: "checkbox",
+                  name: "fields",
+                  value: r.name,
+                  checked: true,
+                }),
+            },
+            { label: req.__("Name"), key: "name" },
+            { label: req.__("Type"), key: (r) => r.type || "—" },
+            { label: req.__("Status"), key: (r) => statusBadge(r.status) },
+          ],
+          ghosts,
+          { hover: true }
+        ),
+        button(
+          {
+            type: "submit",
+            class: "btn btn-danger mt-2",
+          },
+          req.__("Remove selected ghosts from Saltcorn")
+        )
+      );
+    }
+
+    let orphanForm = "";
+    if (orphans.length > 0) {
+      orphanForm = form(
+        {
+          method: "post",
+          action: `/table/rescan-import/${table.id}`,
+        },
+        input({ type: "hidden", name: "_csrf", value: req.csrfToken() }),
+        h4(
+          { class: "text-primary" },
+          req.__("Orphan columns (in DB, not in Saltcorn)")
+        ),
+        mkTable(
+          [
+            {
+              label: "",
+              key: (r) =>
+                input({
+                  type: "checkbox",
+                  name: "columns",
+                  value: r.name,
+                  checked: true,
+                }),
+            },
+            { label: req.__("Column"), key: "name" },
+            { label: req.__("SQL Type"), key: (r) => r.type || "—" },
+            { label: req.__("Status"), key: (r) => statusBadge(r.status) },
+          ],
+          orphans,
+          { hover: true }
+        ),
+        button(
+          {
+            type: "submit",
+            class: "btn btn-primary mt-2",
+          },
+          req.__("Import selected orphans into Saltcorn")
+        )
+      );
+    }
+
+    let matchCard = "";
+    if (matches.length > 0) {
+      matchCard = div(
+        h4(req.__("Matching fields (%d)", matches.length)),
+        mkTable(
+          [
+            { label: req.__("Name"), key: "name" },
+            { label: req.__("Type"), key: (r) => r.type || "—" },
+            { label: req.__("Status"), key: (r) => statusBadge(r.status) },
+          ],
+          matches,
+          { hover: true }
+        )
+      );
+    }
+
+    const allMatch = ghosts.length === 0 && orphans.length === 0;
+
+    res.sendWrap(req.__("Rescan fields: %s", table.name), {
+      above: [
+        {
+          type: "breadcrumbs",
+          crumbs: [
+            { text: req.__("Tables"), href: "/table" },
+            {
+              text: table.name,
+              href: `/table/${encodeURIComponent(table.name)}`,
+            },
+            { text: req.__("Rescan fields") },
+          ],
+        },
+        allMatch && {
+          type: "card",
+          title: req.__("All fields match"),
+          contents:
+            p(req.__("All Saltcorn fields match the database columns.")) +
+            a(
+              { href: `/table/${table.id}`, class: "btn btn-primary" },
+              req.__("Back to table")
+            ),
+        },
+        ghosts.length > 0 && {
+          type: "card",
+          title: req.__("Ghosts (%d)", ghosts.length),
+          contents: ghostForm,
+        },
+        orphans.length > 0 && {
+          type: "card",
+          title: req.__("Orphans (%d)", orphans.length),
+          contents: orphanForm,
+        },
+        matches.length > 0 && {
+          type: "card",
+          title: req.__("Matches"),
+          contents: matchCard,
+        },
+      ].filter(Boolean),
+    });
+  })
+);
+
+/**
+ * Rescan Delete Ghosts (POST Handler)
+ * @name post/rescan-delete/:idorname
+ * @function
+ * @memberof module:routes/tables~tablesRouter
+ */
+router.post(
+  "/rescan-delete/:idorname",
+  isAdmin,
+  error_catcher(async (req, res) => {
+    const { idorname } = req.params;
+    let id = parseInt(idorname);
+    let table;
+    if (id) [table] = await Table.find({ id });
+    if (!table) [table] = await Table.find({ name: idorname });
+    if (!table) {
+      req.flash("error", req.__(`Table not found`));
+      res.redirect(`/table`);
+      return;
+    }
+
+    const fieldNames = Array.isArray(req.body.fields)
+      ? req.body.fields
+      : req.body.fields
+        ? [req.body.fields]
+        : [];
+    const fields = table.getFields();
+    let removed = 0;
+
+    for (const fname of fieldNames) {
+      const field = fields.find((f) => f.name === fname);
+      if (field) {
+        await db.deleteWhere("_sc_fields", { id: field.id });
+        removed++;
+      }
+    }
+
+    await getState().refresh_tables(true);
+    req.flash(
+      "success",
+      req.__("Removed %d ghost field(s) from Saltcorn", removed)
+    );
+    res.redirect(`/table/rescan/${table.id}`);
+  })
+);
+
+/**
+ * Rescan Import Orphans (POST Handler)
+ * @name post/rescan-import/:idorname
+ * @function
+ * @memberof module:routes/tables~tablesRouter
+ */
+router.post(
+  "/rescan-import/:idorname",
+  isAdmin,
+  error_catcher(async (req, res) => {
+    const { idorname } = req.params;
+    let id = parseInt(idorname);
+    let table;
+    if (id) [table] = await Table.find({ id });
+    if (!table) [table] = await Table.find({ name: idorname });
+    if (!table) {
+      req.flash("error", req.__(`Table not found`));
+      res.redirect(`/table`);
+      return;
+    }
+
+    const colNames = Array.isArray(req.body.columns)
+      ? req.body.columns
+      : req.body.columns
+        ? [req.body.columns]
+        : [];
+    let imported = 0;
+    const skipped = [];
+
+    const schema = db.getTenantSchema();
+
+    for (const colName of colNames) {
+      // Get column info from DB and build a field config
+      let fieldCfg;
+      if (!db.isSQLite) {
+        const { rows } = await db.query(
+          "SELECT * FROM information_schema.columns WHERE table_schema = $1 AND table_name = $2 AND column_name = $3",
+          [schema, table.name, colName]
+        );
+        if (rows.length) {
+          fieldCfg = await make_field(rows[0]);
+          // Fallback: if make_field couldn't determine the type, try findType directly
+          if (!fieldCfg || !fieldCfg.type) {
+            const sqlType =
+              findType(rows[0].data_type) ||
+              findType(rows[0].udt_name) ||
+              "String";
+            fieldCfg = {
+              name: rows[0].column_name,
+              label: rows[0].column_name,
+              type: sqlType,
+              required: rows[0].is_nullable === "NO",
+            };
+          }
+        }
+      } else {
+        const { rows } = await db.query(`PRAGMA table_info("${table.name}")`);
+        const col = rows.find((r) => r.name === colName);
+        if (col) {
+          const type = findType(col.type) || "String";
+          fieldCfg = {
+            name: colName,
+            label: colName,
+            type,
+            required: col.notnull === 1,
+          };
+        }
+      }
+
+      if (fieldCfg && fieldCfg.type) {
+        // Insert directly into _sc_fields — the physical column already exists,
+        // so we must NOT use Field.create (which does ALTER TABLE ADD COLUMN).
+        const typeName =
+          typeof fieldCfg.type === "string"
+            ? fieldCfg.type
+            : fieldCfg.type?.name;
+        await db.insert("_sc_fields", {
+          table_id: table.id,
+          name: fieldCfg.name,
+          label: fieldCfg.label || fieldCfg.name,
+          type: typeName,
+          required: !!fieldCfg.required,
+          is_unique: !!fieldCfg.is_unique,
+          primary_key: !!fieldCfg.primary_key,
+        });
+        imported++;
+      } else {
+        skipped.push(colName);
+      }
+    }
+
+    await getState().refresh_tables(true);
+    const msgs = [
+      req.__("Imported %d orphan column(s) into Saltcorn", imported),
+    ];
+    if (skipped.length)
+      msgs.push(
+        req.__(
+          "Skipped %d column(s) with unrecognized type: %s",
+          skipped.length,
+          skipped.join(", ")
+        )
+      );
+    req.flash("success", msgs.join(". "));
+    res.redirect(`/table/rescan/${table.id}`);
+  })
+);
+
 /**
  * Table Constructor (GET Handler)
  * @name get/:idorname
@@ -1175,6 +1514,13 @@ router.get(
         div(
           { class: "mx-auto" },
           settingsDropdown(`dataMenuButton`, [
+            a(
+              {
+                class: "dropdown-item",
+                href: `/table/rescan/${table.id}`,
+              },
+              '<i class="fas fa-search"></i>&nbsp;' + req.__("Rescan fields")
+            ),
             // rename table doesnt supported for sqlite
             !db.isSQLite &&
               user_can_edit_tables &&
@@ -2778,16 +3124,38 @@ const standardFieldForm = (table, req, existingNames = new Set()) => {
   const defs = standardFieldDefs(req).filter(
     (def) => !existingNames.has(def.name)
   );
+  const default_labels = getState().getConfig(
+    "default_standard_field_labels",
+    {}
+  );
   return new Form({
     submitLabel: req.__("Create fields"),
     action: `/table/create-standard-fields/${table.id}`,
     formStyle: "vert",
-    fields: defs.map((def) => ({
-      type: "Bool",
-      label: `${def.label} (${def.type})`,
-      name: def.name,
-      default: true,
-    })),
+    fields: [
+      ...defs
+        .map((def) => [
+          {
+            type: "Bool",
+            label: `${def.label} (${def.type})`,
+            name: def.name,
+            default: true,
+          },
+          {
+            type: "String",
+            label: `${def.label} field label`,
+            name: `${def.name}_label`,
+            default: default_labels[def.name] || def.label,
+            showIf: { set_custom_labels: true, [def.name]: true },
+          },
+        ])
+        .flat(1),
+      {
+        name: "set_custom_labels",
+        label: req.__("Set custom labels"),
+        type: "Bool",
+      },
+    ],
   });
 };
 
@@ -2831,10 +3199,21 @@ router.post(
       return;
     }
     const defs = standardFieldDefs(req);
+    const default_labels = getState().getConfig(
+      "default_standard_field_labels",
+      {}
+    );
+    const new_defaults = {};
     await db.withTransaction(async () => {
       for (const def of defs) {
         if (!form.values[def.name]) continue;
         if (existingNames.has(def.name)) continue;
+        const custom_label_value = form.values[`${def.name}_label`];
+        if (form.values.set_custom_labels && custom_label_value) {
+          def.label = custom_label_value;
+          if (custom_label_value !== default_labels[def.name])
+            new_defaults[def.name] = custom_label_value;
+        }
         await Field.create({
           table_id: table.id,
           name: def.name,
@@ -2849,6 +3228,12 @@ router.post(
         });
       }
     });
+    if (Object.keys(new_defaults).length)
+      await getState().setConfig("default_standard_field_labels", {
+        ...default_labels,
+        ...new_defaults,
+      });
+
     await getState().refresh_tables();
     res.redirect(`/table/${table.id}`);
   })

package/routes/utils.js

@@ -66,7 +66,15 @@ const get_sys_info = async () => {
  * @returns {void}
  */
 function loggedIn(req, res, next) {
-  if (req.user && req.user.id && req.user.tenant === db.getTenantSchema()) {
+  if (req.user && req.user.id) {
+    // Reject tenant drift so a session authenticated elsewhere cannot be reused here.
+    if (
+      req.user.tenant !== undefined &&
+      req.user.tenant !== db.getTenantSchema()
+    ) {
+      req.logout?.(() => {});
+      return res.status(403).json({ error: "Session tenant mismatch" });
+    }
     next();
   } else {
     req.flash("danger", req.__("Must be logged in first"));
@@ -85,7 +93,12 @@ function loggedIn(req, res, next) {
 function isAdmin(req, res, next) {
   const cur_tenant = db.getTenantSchema();
   //console.log({ cur_tenant, user: req.user });
-  if (req.user && req.user.role_id === 1 && req.user.tenant === cur_tenant) {
+  if (req.user && req.user.role_id === 1) {
+    // Reject tenant drift before honoring elevated privileges in this schema.
+    if (req.user.tenant !== undefined && req.user.tenant !== cur_tenant) {
+      req.logout?.(() => {});
+      return res.status(403).json({ error: "Session tenant mismatch" });
+    }
     next();
   } else {
     req.flash("danger", req.__("Must be admin"));
@@ -145,6 +158,20 @@ const setLanguage = (req, res, state) => {
   set_custom_http_headers(res, req, state);
 };
 
+const applyUserLocale = (req, res, next) => {
+  if (req.user) {
+    if (req.user.language) {
+      req.setLocale(req.user.language);
+      const rtlLanguages = ["ar", "he", "fa", "ur", "yi"];
+      req.isRTL = rtlLanguages.some((lang) =>
+        req.user.language.startsWith(lang)
+      );
+    }
+    Object.freeze(req.user);
+  }
+  next();
+};
+
 /**
  * Sets Custom HTTP headers using data from "custom_http_headers" config variable
  * @param {object} res
@@ -178,6 +205,19 @@ const set_custom_http_headers = (res, req, state) => {
   }
 };
 
+/**
+ * Validates the raw Host header before any tenant parsing happens.
+ * @param {object} req
+ * @returns {boolean}
+ */
+const validateHostAuthority = (req) => {
+  const host = req.headers?.["host"];
+  if (typeof host !== "string") return false;
+  if (host.includes(",") || /\s|\x00/.test(host)) return false;
+  const hostname = host.split(":")[0];
+  return /^[a-zA-Z0-9._\-[\]]+$/.test(hostname);
+};
+
 /**
  * Tries to recognize tenant from HTTP Request
  * @param {object} req
@@ -207,6 +247,11 @@ const get_tenant_from_req = (req, hostPartsOffset) => {
  * @param {function} next
  */
 const setTenant = (req, res, next) => {
+  // Reject malformed authority values before subdomain parsing can switch tenant context.
+  if (!validateHostAuthority(req)) {
+    res.status(400).json({ error: "Invalid Host header" });
+    return;
+  }
   // for a saltcorn mobile request use 'req.user.tenant'
   if (req.smr) {
     if (req.user?.tenant && req.user.tenant !== db.connectObj.default_schema) {
@@ -359,7 +404,7 @@ const getSessionStore = (pruneInterval) => {
       secret: db.connectObj.session_secret || is.str.generate(),
       resave: false,
       saveUninitialized: false,
-      cookie: { maxAge: 30 * 24 * 60 * 60 * 1000, sameSite }, // 30 days
+      cookie: { maxAge: 30 * 24 * 60 * 60 * 1000, sameSite, secure: "auto" }, // 30 days
     });
   } else {
     const pgSession = require("connect-pg-simple")(session);
@@ -373,7 +418,7 @@ const getSessionStore = (pruneInterval) => {
       secret: db.connectObj.session_secret || is.str.generate(),
       resave: false,
       saveUninitialized: false,
-      cookie: { maxAge: 30 * 24 * 60 * 60 * 1000, sameSite }, // 30 days
+      cookie: { maxAge: 30 * 24 * 60 * 60 * 1000, sameSite, secure: "auto" }, // 30 days
     });
   }
 };
@@ -491,6 +536,72 @@ const admin_config_route = ({
   );
 };
 
+/**
+ * Send an HTML string response with injected Saltcorn globals (CSRF token,
+ * version tag, locale, page-load tag, admin flag) and normalised static-asset paths.
+ * @param {any} req
+ * @param {any} res
+ * @param {string} html_string
+ * @returns
+ */
+const sendHtmlStringWithGlobals = (req, res, html_string) => {
+  res.set("Content-Type", "text/html");
+  const state = getState();
+  const version_tag = db.connectObj.version_tag;
+  const locale = req.getLocale?.();
+  const scGlobals =
+    `<script>var _sc_globalCsrf = ${JSON.stringify(req.csrfToken())}` +
+    `, _sc_version_tag = ${JSON.stringify(version_tag)}` +
+    (locale ? `, _sc_locale = ${JSON.stringify(locale)}` : "") +
+    `, _sc_pageloadtag = Math.floor(Math.random() * 16777215).toString(16)` +
+    (req?.user?.role_id === 1 ? `, _sc_is_admin = true` : "") +
+    `;</script>`;
+  const normalized = html_string.replace(
+    /\/static_assets\/[a-f0-9]+\//g,
+    `/static_assets/${version_tag}/`
+  );
+  const assetBase = `/static_assets/${version_tag}`;
+
+  // CSS and scGlobals go into <head>; scripts go before </body> (after jQuery).
+  // Core scripts (dayjs, socket.io) come before plugin scripts from state.headers.
+  let headInject = scGlobals;
+  if (!normalized.includes("saltcorn.css"))
+    headInject += `<link rel="stylesheet" href="${assetBase}/saltcorn.css">`;
+  if (!normalized.includes("saltcorn.js"))
+    headInject += `<script src="${assetBase}/saltcorn.js"></script>`;
+
+  let bodyInject = "";
+  for (const fname of ["dayjs.min.js", "socket.io.min.js"]) {
+    if (!normalized.includes(fname))
+      bodyInject += `<script src="${assetBase}/${fname}"></script>`;
+  }
+  if (locale && !normalized.includes(`dayjslocales/${locale}.js`))
+    bodyInject += `<script src="${assetBase}/dayjslocales/${locale}.js"></script>`;
+  if (!normalized.includes("dynamic_updates_cfg")) {
+    const dynamic_updates_enabled = state.getConfig("enable_dynamic_updates", false);
+    bodyInject += `<script>var dynamic_updates_cfg = ${JSON.stringify({ enabled: dynamic_updates_enabled })};</script>`;
+  }
+
+  const stateHeaders = Array.isArray(state.headers)
+    ? state.headers
+    : Object.values(state.headers || {}).flat();
+  for (const h of stateHeaders) {
+    if (h.css && !normalized.includes(h.css))
+      headInject += `<link rel="stylesheet" href="${h.css}">`;
+    else if (h.script && !normalized.includes(h.script))
+      bodyInject += `<script src="${h.script}"></script>`;
+  }
+
+  let html = normalized.includes("</head>")
+    ? normalized.replace("</head>", `${headInject}</head>`)
+    : headInject + normalized;
+  if (bodyInject)
+    html = html.includes("</body>")
+      ? html.replace("</body>", `${bodyInject}</body>`)
+      : html + bodyInject;
+  return res.send(html);
+};
+
 /**
  * Send HTML file to client without any menu
  * @param {any} req
@@ -652,6 +763,8 @@ module.exports = {
   scan_for_page_title,
   getGitRevision,
   getSessionStore,
+  validateHostAuthority,
+  applyUserLocale,
   setTenant,
   get_tenant_from_req,
   addOnDoneRedirect,
@@ -662,6 +775,7 @@ module.exports = {
   get_sys_info,
   admin_config_route,
   sendHtmlFile,
+  sendHtmlStringWithGlobals,
   setRole,
   getEligiblePage,
   getRandomPage,

package/routes/viewedit.js

@@ -131,8 +131,8 @@ const mapObjectValues = (o, f) =>
  * @returns {Form}
  */
 const viewForm = async (req, tableOptions, roles, pages, values) => {
-  const isEdit =
-    values && values.id && !getState().getConfig("development_mode", false);
+  const devmode = getState().getConfig("development_mode", false);
+  const isEdit = values && values.id && !devmode;
   const hasTable = Object.entries(getState().viewtemplates)
     .filter(([k, v]) => !v.tableless && !v.table_optional)
     .map(([k, v]) => k);
@@ -141,7 +141,7 @@ const viewForm = async (req, tableOptions, roles, pages, values) => {
     .map(([k, v]) => k);
   const slugOptions = await Table.allSlugOptions();
   const viewpatternOptions = Object.values(getState().viewtemplates)
-    .filter((vt) => !vt.singleton)
+    .filter((vt) => !vt.singleton && !(!values && vt.deprecated && !devmode))
     .map((vt) => vt.name);
   return new Form({
     action: addOnDoneRedirect("/viewedit/save", req),
@@ -173,7 +173,10 @@ const viewForm = async (req, tableOptions, roles, pages, values) => {
         attributes: {
           explainers: mapObjectValues(
             getState().viewtemplates,
-            ({ description }) => description
+            ({ description, deprecated }) =>
+              deprecated && description
+                ? `${description}. <i>${req.__("Deprecated")}</i>`
+                : description || (deprecated ? req.__("Deprecated") : undefined)
           ),
         },
         disabled: isEdit,
@@ -919,6 +922,25 @@ router.post(
   })
 );
 
+router.get(
+  "/getlayout/:id",
+  isAdminOrHasConfigMinRole("min_role_edit_views"),
+  error_catcher(async (req, res) => {
+    const { id } = req.params;
+
+    if (id) {
+      const view = await View.findOne({ id });
+      if (!view) {
+        res.json({ error: req.__("No view") });
+        return;
+      }
+      res.json({ success: "ok", layout: view.configuration.layout });
+    } else {
+      res.json({ error: req.__("No view") });
+    }
+  })
+);
+
 /**
  * @name post/saveconfig/:id
  * @function