@things-factory/shell 10.1.227 → 10.1.234

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/shell",
-  "version": "10.1.227",
+  "version": "10.1.234",
   "description": "Core module for framework",
   "bin": {
     "things-factory": "bin/things-factory",
@@ -142,5 +142,5 @@
     "pg": "^8.7.3",
     "sqlite3": "^5.0.8"
   },
-  "gitHead": "f66591e3864aab08a6fb93fb1fcf1c9de6b546ac"
+  "gitHead": "92f29853680fff527a5f1d167ab3ad9b27837ba9"
 }

package/tests/ip-list-rule.test.ts

@@ -0,0 +1,87 @@
+/* The domain is given in state, so the URL lookup is never reached - and importing it drags in every entity. */
+jest.mock('../server/utils/get-domain', () => ({ getDomainFromURL: jest.fn() }))
+
+import { domainMiddleware, REFUSAL_HEADER, REFUSED_ADDRESS } from '../server/middlewares/domain-middleware'
+import { refuseBadIPList } from '../server/middlewares/ip-list-rule'
+
+/**
+ * One IP list entry that is not a regular expression used to throw on every request of the domain - nobody got
+ * in, with a server error. Saving refuses it by list and entry; one already stored is passed over.
+ */
+
+function run(iplist: any, ip: string) {
+  const headers: Record<string, string> = {}
+  const context: any = {
+    state: { domain: { id: 'd1', iplist } },
+    req: { headers: { 'x-client-ip': ip }, connection: {}, socket: {} },
+    status: 200,
+    set: (name: string, value: string) => (headers[name.toLowerCase()] = value)
+  }
+  let passed = false
+  return domainMiddleware(context, async () => {
+    passed = true
+  }).then(() => ({ status: context.status, headers, passed, unsafeIP: context.state.unsafeIP }))
+}
+
+function refusalOf(iplist: any) {
+  try {
+    refuseBadIPList(iplist)
+  } catch (e: any) {
+    return { code: e.code, params: e.params }
+  }
+}
+
+describe('a stored entry that is not a regular expression', () => {
+  it('★ does not break the request: the other whitelist entries still let the address in', async () => {
+    expect(await run({ whitelist: ['10.0.0.[', '^10\\.'] }, '10.0.0.1')).toMatchObject({ status: 200, passed: true })
+  })
+
+  it('★ matches nothing: an address outside the rest of the whitelist is refused, not a server error', async () => {
+    expect(await run({ whitelist: ['10.0.0.['] }, '10.0.0.1')).toMatchObject({
+      status: 403,
+      headers: { [REFUSAL_HEADER]: REFUSED_ADDRESS },
+      passed: false
+    })
+  })
+
+  it('★ in the blacklist and the protected list it is passed over as well', async () => {
+    expect(await run({ blacklist: ['('] }, '10.0.0.1')).toMatchObject({ status: 200, passed: true })
+    expect(await run({ protectedlist: ['(', '^10\\.'] }, '10.0.0.1')).toMatchObject({ passed: true, unsafeIP: false })
+  })
+})
+
+describe('saving the IP lists', () => {
+  it('★ refuses an entry that is not a regular expression, naming the list and the entry', () => {
+    expect(refusalOf({ whitelist: ['^10\\.', '10.0.0.['] })).toEqual({ code: 'ip-whitelist-entry-invalid', params: { entry: '10.0.0.[' } })
+    expect(refusalOf({ blacklist: ['('] })).toEqual({ code: 'ip-blacklist-entry-invalid', params: { entry: '(' } })
+    expect(refusalOf({ protectedlist: [10] })).toEqual({ code: 'ip-protectedlist-entry-invalid', params: { entry: '10' } })
+  })
+
+  it('★ refuses an empty entry - an empty pattern matches every address', () => {
+    expect(refusalOf({ whitelist: ['^10\\.', ' '] })).toEqual({ code: 'ip-whitelist-entry-empty', params: {} })
+  })
+
+  it('takes lists of regular expressions, and lists left out', () => {
+    expect(refusalOf({ whitelist: ['^10\\.'], blacklist: [], privileges: [{ category: 'board', privilege: 'mutation' }] })).toBeUndefined()
+    expect(refusalOf({})).toBeUndefined()
+    expect(refusalOf(null)).toBeUndefined()
+  })
+
+  it('every refusal has its sentence in Korean and English', () => {
+    for (const locale of ['ko', 'en']) {
+      const sentences = require(`../translations/${locale}.json`)
+      for (const list of ['whitelist', 'blacklist', 'protectedlist']) {
+        for (const kind of ['invalid', 'empty']) {
+          expect([locale, typeof sentences[`error.ip-${list}-entry-${kind}`]]).toEqual([locale, 'string'])
+        }
+      }
+    }
+  })
+
+  it('the save door checks before it writes', () => {
+    const source = require('fs').readFileSync(require('path').resolve(__dirname, '../server/service/domain/domain-mutation.ts'), 'utf8')
+    const door = source.slice(source.indexOf('async updateSecureIPList('))
+    expect(door.indexOf('refuseBadIPList(iplist)')).toBeGreaterThan(0)
+    expect(door.indexOf('refuseBadIPList(iplist)')).toBeLessThan(door.indexOf('repository.save'))
+  })
+})

package/translations/en.json

@@ -198,5 +198,19 @@
   "button.scan-with-camera": "scan with camera",
   "figure.label.motion": "Motion",
   "figure.text.preview-needs-a-part": "add a part to see how it looks placed on a drawing.",
-  "error.timezone-required": "The $t(term.domain) has no timezone. Set it in $t(term.domain) management."
+  "error.timezone-required": "The $t(term.domain) has no timezone. Set it in $t(term.domain) management.",
+  "button.preview": "Preview",
+  "title.preview": "Preview",
+  "field.counterparty": "counterparty",
+  "text.tax-kind-taxable": "Taxable",
+  "text.tax-kind-zero-rated": "Zero-rated",
+  "text.tax-kind-exempt": "Exempt",
+  "button.rename": "rename",
+  "button.search": "search",
+  "error.ip-whitelist-entry-invalid": "'{entry}' in the allow list is not an IP address regular expression. For example: ^10\\.0\\.",
+  "error.ip-blacklist-entry-invalid": "'{entry}' in the block list is not an IP address regular expression. For example: ^10\\.0\\.",
+  "error.ip-protectedlist-entry-invalid": "'{entry}' in the protected list is not an IP address regular expression. For example: ^10\\.0\\.",
+  "error.ip-whitelist-entry-empty": "The allow list has an empty entry. Leave nothing empty between commas.",
+  "error.ip-blacklist-entry-empty": "The block list has an empty entry. Leave nothing empty between commas.",
+  "error.ip-protectedlist-entry-empty": "The protected list has an empty entry. Leave nothing empty between commas."
 }

package/translations/es.json

@@ -198,5 +198,13 @@
   "button.scan-with-camera": "escanear con la cámara",
   "figure.label.motion": "Movimiento",
   "figure.text.preview-needs-a-part": "añada una pieza para ver cómo se ve colocada en un plano.",
-  "error.timezone-required": "El dominio no tiene zona horaria. Configúrela en la gestión de dominios."
+  "error.timezone-required": "El dominio no tiene zona horaria. Configúrela en la gestión de dominios.",
+  "button.preview": "Vista previa",
+  "title.preview": "Vista previa",
+  "field.counterparty": "contraparte",
+  "text.tax-kind-taxable": "Gravado",
+  "text.tax-kind-zero-rated": "Tipo cero",
+  "text.tax-kind-exempt": "Exento",
+  "button.rename": "cambiar nombre",
+  "button.search": "buscar"
 }

package/translations/ja.json

@@ -198,5 +198,13 @@
   "button.scan-with-camera": "カメラでスキャン",
   "figure.label.motion": "Motion",
   "figure.text.preview-needs-a-part": "部品を追加すると、図面に置いたときの姿が表示されます。",
-  "error.timezone-required": "事業所のタイムゾーンが設定されていません。事業所管理でタイムゾーンを設定してください。"
+  "error.timezone-required": "事業所のタイムゾーンが設定されていません。事業所管理でタイムゾーンを設定してください。",
+  "button.preview": "プレビュー",
+  "title.preview": "プレビュー",
+  "field.counterparty": "取引先",
+  "text.tax-kind-taxable": "課税",
+  "text.tax-kind-zero-rated": "ゼロ税率",
+  "text.tax-kind-exempt": "免税",
+  "button.rename": "名前変更",
+  "button.search": "検索"
 }

package/translations/ko.json

@@ -198,5 +198,19 @@
   "button.scan-with-camera": "카메라로 스캔",
   "figure.label.motion": "움직임",
   "figure.text.preview-needs-a-part": "부품을 추가하면 도면에 놓았을 때의 모습이 표시됩니다.",
-  "error.timezone-required": "$t(term.domain) 시간대가 정해지지 않았습니다. $t(term.domain) 관리에서 시간대를 정하세요."
+  "error.timezone-required": "$t(term.domain) 시간대가 정해지지 않았습니다. $t(term.domain) 관리에서 시간대를 정하세요.",
+  "button.preview": "미리 보기",
+  "title.preview": "미리 보기",
+  "field.counterparty": "거래처",
+  "text.tax-kind-taxable": "과세",
+  "text.tax-kind-zero-rated": "영세율",
+  "text.tax-kind-exempt": "면세",
+  "button.rename": "이름변경",
+  "button.search": "찾기",
+  "error.ip-whitelist-entry-invalid": "허용 목록의 '{entry}'는 IP 주소 정규식이 아닙니다. 예: ^10\\.0\\.",
+  "error.ip-blacklist-entry-invalid": "차단 목록의 '{entry}'는 IP 주소 정규식이 아닙니다. 예: ^10\\.0\\.",
+  "error.ip-protectedlist-entry-invalid": "보호 목록의 '{entry}'는 IP 주소 정규식이 아닙니다. 예: ^10\\.0\\.",
+  "error.ip-whitelist-entry-empty": "허용 목록에 빈 항목이 있습니다. 쉼표 사이를 비우지 마세요.",
+  "error.ip-blacklist-entry-empty": "차단 목록에 빈 항목이 있습니다. 쉼표 사이를 비우지 마세요.",
+  "error.ip-protectedlist-entry-empty": "보호 목록에 빈 항목이 있습니다. 쉼표 사이를 비우지 마세요."
 }

package/translations/ms.json

@@ -198,5 +198,13 @@
   "button.scan-with-camera": "imbas dengan kamera",
   "figure.label.motion": "Motion",
   "figure.text.preview-needs-a-part": "tambah bahagian untuk melihat rupanya apabila diletakkan pada lukisan.",
-  "error.timezone-required": "Domain tiada zon waktu. Tetapkannya dalam pengurusan domain."
+  "error.timezone-required": "Domain tiada zon waktu. Tetapkannya dalam pengurusan domain.",
+  "button.preview": "Pratonton",
+  "title.preview": "Pratonton",
+  "field.counterparty": "rakan niaga",
+  "text.tax-kind-taxable": "Bercukai",
+  "text.tax-kind-zero-rated": "Kadar sifar",
+  "text.tax-kind-exempt": "Dikecualikan",
+  "button.rename": "Namakan Semula",
+  "button.search": "cari"
 }

package/translations/zh.json

@@ -198,5 +198,13 @@
   "button.scan-with-camera": "用摄像头扫描",
   "figure.label.motion": "Motion",
   "figure.text.preview-needs-a-part": "添加部件后会显示放置到图面上的效果。",
-  "error.timezone-required": "尚未设置单位时区。请在单位管理中设置时区。"
+  "error.timezone-required": "尚未设置单位时区。请在单位管理中设置时区。",
+  "button.preview": "预览",
+  "title.preview": "预览",
+  "field.counterparty": "往来单位",
+  "text.tax-kind-taxable": "应税",
+  "text.tax-kind-zero-rated": "零税率",
+  "text.tax-kind-exempt": "免税",
+  "button.rename": "名称变更",
+  "button.search": "搜索"
 }