@tachybase/module-collection 1.6.24 → 1.6.26

package/dist/server/repositories/collection-repository.d.ts

@@ -3,6 +3,9 @@ interface LoadOptions {
     filter?: any;
     skipExist?: boolean;
 }
+/**
+ * Provides the collection repository helper for this module.
+ */
 export declare class CollectionRepository extends Repository {
     private app;
     setApp(app: any): void;

package/dist/server/repositories/collection-repository.js

@@ -44,6 +44,7 @@ class CollectionRepository extends import_server.Repository {
     const graph = new graphlib.Graph();
     const nameMap = {};
     const viewCollections = [];
+    const db2cmCollections = [];
     const customCollections = [];
     for (const instance of instances) {
       graph.setNode(instance.get("name"));
@@ -71,9 +72,14 @@ class CollectionRepository extends import_server.Repository {
     for (const instanceName of sortedNames) {
       if (!nameMap[instanceName]) continue;
       const skipField = (() => {
+        var _a2;
         if (viewCollections.includes(instanceName)) {
           return true;
         }
+        const collectionSource = nameMap[instanceName].get("from") ?? ((_a2 = nameMap[instanceName].get("options")) == null ? void 0 : _a2.from);
+        if (collectionSource === "db2cm" && this.database.hasCollection(instanceName)) {
+          return true;
+        }
         const fields = nameMap[instanceName].get("fields");
         return fields.filter((field) => field["type"] === "belongsTo" || field["type"] === "belongsToMany").map((field) => field.get("name"));
       })();
@@ -88,7 +94,7 @@ class CollectionRepository extends import_server.Repository {
       (_a = this.app) == null ? void 0 : _a.setMaintainingMessage(`load ${instanceName} collection`);
       await nameMap[instanceName].load({ skipField });
     }
-    for (const viewCollectionName of viewCollections) {
+    for (const viewCollectionName of /* @__PURE__ */ new Set([...viewCollections, ...db2cmCollections])) {
       process.env.DEBUG_LOAD_COLLECTION_FIELDS && this.database.logger.debug(`load collection fields`, {
         submodule: "CollectionRepository",
         method: "load",

package/dist/server/resourcers/sql.d.ts

@@ -1,4 +1,31 @@
-import { Context, Next } from '@tego/server';
+import { Context, Next, SQLModel } from '@tego/server';
+/**
+ * Normalizes SQL by parsing and re-serializing it, removing comments and literal formatting noise.
+ */
+export declare function stripSqlCommentsAndLiterals(sql: string): string;
+/**
+ * Validates that preview SQL contains exactly one read-only SELECT/CTE statement.
+ */
+export declare function isReadOnlyPreviewSql(sql: string): boolean;
+/**
+ * Executes SQL preview reads inside a read-only transaction where the dialect supports it.
+ */
+export declare function runReadOnlyPreviewQuery(ctx: Context, model: typeof SQLModel): Promise<SQLModel[]>;
+/**
+ * SQL collection resource.
+ *
+ * Tenant isolation boundary:
+ * - `execute` runs raw SQL with no tenant filtering. The SQL is only validated
+ *   to be a SELECT/CTE query (non-mutating for preview purposes), but there is
+ *   no framework-level tenant scoping.
+ * - `setFields` and `update` are configuration operations (not data access),
+ *   and are gated by the default ACL deny-all for non-admin roles.
+ * - No `tenantId` is injected into queries. The tenant resource guard does not
+ *   apply to this resource because SQL collections do not have a `tenancy` option.
+ * - If a tenant-scoped view of data is needed, users should construct their SQL
+ *   to include the appropriate `WHERE tenantId = ...` clause manually, or use
+ *   a general collection with proper tenancy configuration.
+ */
 declare const _default: {
     name: string;
     actions: {

package/dist/server/resourcers/sql.js

@@ -17,10 +17,36 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var sql_exports = {};
 __export(sql_exports, {
-  default: () => sql_default
+  default: () => sql_default,
+  isReadOnlyPreviewSql: () => isReadOnlyPreviewSql,
+  runReadOnlyPreviewQuery: () => runReadOnlyPreviewQuery,
+  stripSqlCommentsAndLiterals: () => stripSqlCommentsAndLiterals
 });
 module.exports = __toCommonJS(sql_exports);
 var import_server = require("@tego/server");
+var import_node_sql_parser = require("node-sql-parser");
+function assertCollectionConfigPermission(ctx) {
+  var _a, _b, _c;
+  const roleName = (_a = ctx.state) == null ? void 0 : _a.currentRole;
+  if (!roleName) {
+    ctx.throw(403, "SQL collection configuration requires a valid role");
+  }
+  if (roleName === "root") {
+    return;
+  }
+  const acl = ((_b = ctx.app) == null ? void 0 : _b.acl) || ((_c = ctx.tego) == null ? void 0 : _c.acl);
+  if (!acl) {
+    ctx.throw(403, "SQL collection configuration requires the pm.database-connections.collections permission");
+  }
+  const aclRole = acl.getRole(roleName);
+  if (!aclRole) {
+    ctx.throw(403, "SQL collection configuration requires the pm.database-connections.collections permission");
+  }
+  const { allowed } = aclRole.effectiveSnippets();
+  if (!allowed.includes("pm.database-connections.collections")) {
+    ctx.throw(403, "SQL collection configuration requires the pm.database-connections.collections permission");
+  }
+}
 const updateCollection = async (ctx, transaction) => {
   const { filterByTk, values } = ctx.action.params;
   const repo = ctx.db.getRepository("collections");
@@ -46,6 +72,89 @@ const updateCollection = async (ctx, transaction) => {
   });
   return { collection, upRes };
 };
+const sqlParser = new import_node_sql_parser.Parser();
+const SQL_PARSE_DIALECTS = ["postgresql", "mysql", "sqlite"];
+function stripSqlCommentsAndLiterals(sql) {
+  const parsed = parseSql(sql);
+  if (!parsed) {
+    return "";
+  }
+  return sqlParser.sqlify(parsed.ast, { database: parsed.database });
+}
+function parseSql(sql) {
+  for (const database of SQL_PARSE_DIALECTS) {
+    try {
+      return {
+        ast: sqlParser.astify(sql, { database }),
+        database
+      };
+    } catch {
+    }
+  }
+  return null;
+}
+function getWithStatement(stmt) {
+  if (!stmt) {
+    return null;
+  }
+  return "ast" in stmt && stmt.ast ? stmt.ast : stmt;
+}
+function isReadOnlyStatement(ast) {
+  var _a, _b;
+  const statement = ast;
+  if (statement.type !== "select") {
+    return false;
+  }
+  if ((_a = statement.into) == null ? void 0 : _a.position) {
+    return false;
+  }
+  if ((_b = statement.with) == null ? void 0 : _b.some((item) => !getWithStatement(item.stmt) || !isReadOnlyStatement(getWithStatement(item.stmt)))) {
+    return false;
+  }
+  if (statement._next && !isReadOnlyStatement(statement._next)) {
+    return false;
+  }
+  return true;
+}
+function isReadOnlyPreviewSql(sql) {
+  const parsed = parseSql(sql);
+  if (!parsed) {
+    return false;
+  }
+  const statements = Array.isArray(parsed.ast) ? parsed.ast : [parsed.ast];
+  if (statements.length !== 1) {
+    return false;
+  }
+  return isReadOnlyStatement(statements[0]);
+}
+function getDialect(ctx) {
+  var _a, _b, _c;
+  return ((_b = (_a = ctx.db.sequelize).getDialect) == null ? void 0 : _b.call(_a)) || ((_c = ctx.db.options) == null ? void 0 : _c.dialect);
+}
+async function applyReadOnlyTransactionGuard(ctx, transaction) {
+  const dialect = getDialect(ctx);
+  if (dialect === "postgres") {
+    await ctx.db.sequelize.query("SET TRANSACTION READ ONLY", { transaction });
+  }
+}
+function getPreviewQueryOptions(transaction) {
+  return {
+    // The result is for preview only, add limit clause to avoid too many results.
+    attributes: [(0, import_server.literal)("*")],
+    limit: 5,
+    raw: true,
+    ...transaction ? { transaction } : {}
+  };
+}
+async function runReadOnlyPreviewQuery(ctx, model) {
+  if (getDialect(ctx) === "sqlite") {
+    return await model.findAll(getPreviewQueryOptions());
+  }
+  return ctx.db.sequelize.transaction({ readOnly: true }, async (transaction) => {
+    await applyReadOnlyTransactionGuard(ctx, transaction);
+    return await model.findAll(getPreviewQueryOptions(transaction));
+  });
+}
 var sql_default = {
   name: "sqlCollection",
   actions: {
@@ -53,16 +162,16 @@ var sql_default = {
       let {
         values: { sql }
       } = ctx.action.params;
-      sql = sql.trim().split(";").shift();
+      sql = sql.trim();
       if (!sql) {
         ctx.throw(400, ctx.t("SQL is empty"));
       }
-      if (!/^select/i.test(sql) && !/^with([\s\S]+)select([\s\S]+)/i.test(sql)) {
+      if (!isReadOnlyPreviewSql(sql)) {
         ctx.throw(400, ctx.t("Only select query allowed"));
       }
       const tmpCollection = new import_server.SqlCollection({ name: "tmp", sql }, { database: ctx.db });
       const model = tmpCollection.model;
-      const data = await model.findAll({ attributes: ["*"], limit: 5, raw: true });
+      const data = await runReadOnlyPreviewQuery(ctx, model);
       let fields = {};
       try {
         fields = model.inferFields();
@@ -75,6 +184,7 @@ var sql_default = {
       await next();
     },
     setFields: async (ctx, next) => {
+      assertCollectionConfigPermission(ctx);
       const transaction = await ctx.tego.db.sequelize.transaction();
       try {
         const {
@@ -91,6 +201,7 @@ var sql_default = {
       await next();
     },
     update: async (ctx, next) => {
+      assertCollectionConfigPermission(ctx);
       const transaction = await ctx.tego.db.sequelize.transaction();
       try {
         const { upRes } = await updateCollection(ctx, transaction);
@@ -106,3 +217,9 @@ var sql_default = {
     }
   }
 };
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  isReadOnlyPreviewSql,
+  runReadOnlyPreviewQuery,
+  stripSqlCommentsAndLiterals
+});

package/dist/server/resourcers/views.d.ts

@@ -1,3 +1,17 @@
+/**
+ * Database view resource.
+ *
+ * Tenant isolation boundary:
+ * - `query` executes raw `SELECT * FROM <view> LIMIT/OFFSET` with no tenant filtering.
+ *   The database view itself is responsible for any row-level security.
+ * - `get` and `list` are metadata operations (field inference, view listing),
+ *   not data access, and are gated by the default ACL deny-all for non-admin roles.
+ * - No `tenantId` is injected. The tenant resource guard does not apply because
+ *   view collections do not have a `tenancy` option.
+ * - If tenant isolation is required at the view level, it must be implemented
+ *   via database-level row security policies (e.g. PostgreSQL RLS) on the
+ *   underlying view.
+ */
 declare const _default: {
     name: string;
     actions: {

package/dist/server/server.d.ts

@@ -1,4 +1,7 @@
 import { Filter, Plugin } from '@tego/server';
+/**
+ * Registers the collection manager plugin plugin integration.
+ */
 export declare class CollectionManagerPlugin extends Plugin {
     schema: string;
     private loadFilter;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tachybase/module-collection",
   "displayName": "Data source: Main",
-  "version": "1.6.24",
+  "version": "1.6.26",
   "description": "TachyBase main database, supports relational databases such as MySQL, PostgreSQL, SQLite and so on.",
   "keywords": [
     "Data sources"
@@ -17,7 +17,9 @@
   },
   "license": "Apache-2.0",
   "main": "./dist/server/index.js",
-  "dependencies": {},
+  "dependencies": {
+    "node-sql-parser": "5.3.10"
+  },
   "devDependencies": {
     "@hapi/topo": "^6.0.2",
     "@tachybase/test": "1.6.16",
@@ -28,8 +30,8 @@
     "lodash": "4.17.21",
     "sequelize": "6.37.5",
     "toposort": "^2.0.2",
-    "@tachybase/client": "1.6.24",
-    "@tachybase/module-error-handler": "1.6.24"
+    "@tachybase/client": "1.6.26",
+    "@tachybase/module-error-handler": "1.6.26"
   },
   "description.zh-CN": "TachyBase 主数据库，支持 MySQL、PostgreSQL、SQLite 等关系型数据库。",
   "displayName.zh-CN": "数据源：主数据库",