@websy/websy-designs 1.12.15 → 2.0.1

package/dist/server/routes/v1/api.js

@@ -1,18 +1,24 @@
 const express = require('express')
 const router = express.Router()
-// const PG = require('../helpers/dbHelper')
-// const dbHelper = new PG()
 
-function APIRoutes (dbHelper, authHelper) {
-  router.delete('/:entity/:id', (req, res) => {
-    const sql = `DELETE FROM ${req.params.entity} WHERE ${dbHelper.buildWhereWithId(req.params.entity, req.params.id)}`
-    dbHelper.execute(sql).then(response => res.json(response), err => res.json(err))
+function APIRoutes (dbHelper, authHelper) {  
+  router.delete('/:entity/:id', authHelper.checkPermissions.bind(authHelper), (req, res) => {
+    const { where, values } = dbHelper.buildWhereWithId(req.params.entity, req.params.id)
+    let sql = `DELETE FROM ${req.params.entity} WHERE ${where}`
+    if (!dbHelper.options.entityConfig[req.params.entity]) {
+      sql = 'SELECT 1=1'
+    }
+    dbHelper.execute(sql, values).then(response => res.json(response), err => res.json(err))
   })
-  router.delete('/:entity', (req, res) => {
-    const sql = dbHelper.buildDelete(req.params.entity, req.query.where)
+  router.delete('/:entity', authHelper.checkPermissions.bind(authHelper), (req, res) => {
+    // if (!dbHelper.options.entityConfig[req.params.entity]) {
+    //   return 'SELECT 1=1'
+    // }
+    // const { sql, values } = dbHelper.buildDelete(req.params.entity, req.query.where)
+    const sql = `SELECT 'Cannot perform bulk delete' as result`
     dbHelper.execute(sql).then(response => res.json(response), err => res.json(err))
   })
-  router.get('/currentuser', (req, res) => {
+  router.get('/currentuser', authHelper.checkPermissions.bind(authHelper), (req, res) => {
     let user = {}
     if (req.session && req.session.user) {
       user = req.session.user
@@ -24,28 +30,28 @@ function APIRoutes (dbHelper, authHelper) {
     }
     res.json(user)
   })
-  router.get('/:entity/:id', (req, res) => {
+  router.get('/:entity/:id', authHelper.checkPermissions.bind(authHelper), (req, res) => {
     let lang = process.env.DEFAULT_LANGUAGE
     if (req.session && req.session.language && req.query.notranslate !== 'true') {
       lang = req.session.language
     }
-    const sql = dbHelper.buildSelectWithId(req.params.entity, req.params.id, req.query, req.query.columns, lang)
-    dbHelper.execute(sql).then(response => {      
+    const { sql, values } = dbHelper.buildSelectWithId(req.params.entity, req.params.id, req.query, req.query.columns, lang)
+    dbHelper.execute(sql, values).then(response => {      
       res.json(translate(response))
     }, err => res.json(err))
   })
-  router.get('/:entity', (req, res) => {
+  router.get('/:entity', authHelper.checkPermissions.bind(authHelper), (req, res) => {
     let lang = process.env.DEFAULT_LANGUAGE
     if (req.session && req.session.language && req.query.notranslate !== 'true') {
       lang = req.session.language
     }
-    // console.log(`lang is ${lang}`)
-    const sql = dbHelper.buildSelect(req.params.entity, req.query, req.query.columns, lang)
-    dbHelper.execute(sql).then(response => {
-      if (process.env.RETURN_COUNTS === true || process.env.RETURN_COUNTS === 'true') {  
-        let countWhere = ''      
-        const countSql = `SELECT COUNT(*) as total FROM ${req.params.entity} WHERE ${dbHelper.buildWhere(req.query.where, req.params.entity)}`
-        dbHelper.execute(countSql).then(countResponse => {
+    const { sql, values } = dbHelper.buildSelect(req.params.entity, req.query, req.query.columns, lang)    
+    
+    dbHelper.execute(sql, values).then(response => {
+      if (process.env.RETURN_COUNTS === true || process.env.RETURN_COUNTS === 'true') {        
+        const { where: countWhere, values: countValues } = dbHelper.buildWhere(req.query.where, req.params.entity)
+        const countSql = `SELECT COUNT(*) as total FROM ${req.params.entity} WHERE ${countWhere}`
+        dbHelper.execute(countSql, countValues).then(countResponse => {
           response.totalCount = countResponse.rows[0].total
           res.json(translate(response))  
         })
@@ -55,47 +61,54 @@ function APIRoutes (dbHelper, authHelper) {
       }      
     }, err => res.json(err))
   })
-  router.post('/:entity/upsert', authHelper.checkPermissions, (req, res) => {
+  router.post('/:entity/upsert', authHelper.checkPermissions.bind(authHelper), (req, res) => {
     let user
     if (req.session && req.session.user) {
       user = req.session.user
     }
-    const sql = dbHelper.buildUpsert(req.params.entity, req.body, user)
-    console.log('upsert sql')
-    console.log(sql)
-    dbHelper.execute(sql).then(response => res.json(response), err => res.json(err))
+    if (req.body && req.body.data) {
+      const queries = dbHelper.buildUpsert(req.params.entity, req.body.data, user)            
+      dbHelper.executeUpsert(0, queries, (err) => {
+        if (err) {          
+          res.json(err)
+        }
+        else {
+          res.json(true)
+        }
+      })      
+    }
+    else {
+      res.status(400)
+      res.json({ err: 'Malformed body. Missing data prop' })
+    }
   })
-  router.post('/:entity', authHelper.checkPermissions, (req, res) => {
-    // const sql = dbHelper.buildInsert(req.params.entity, req.body, req.session.passport.user.id)
-    // console.log(req.body)
-    // console.log(req.session)
+  router.post('/:entity', authHelper.checkPermissions.bind(authHelper), (req, res) => {
     let user
     if (req.session && req.session.user) {
       user = req.session.user
     }
-    const sql = dbHelper.buildInsert(req.params.entity, req.body, user)
-    // console.log(sql)
-    dbHelper.execute(sql).then(response => res.json(response), err => {
+    const { sql, values } = dbHelper.buildInsert(req.params.entity, req.body, user)
+    
+    dbHelper.execute(sql, values).then(response => res.json(response), err => {
       res.statusCode = 404
       res.json({err})
     })
-  })  
-  // console.log('defining put endpoint for /:entity/:id')
-  router.put('/:entity/:id', authHelper.checkPermissions, (req, res) => {
+  })
+  router.put('/:entity/:id', authHelper.checkPermissions.bind(authHelper), (req, res) => {
     let user
     if (req.session && req.session.user) {
       user = req.session.user
     }
-    const sql = dbHelper.buildUpdateWithId(req.params.entity, req.params.id, req.body, user)
-    dbHelper.execute(sql).then(response => res.json(response), err => res.json(err))
+    const { sql, values } = dbHelper.buildUpdateWithId(req.params.entity, req.params.id, req.body, user)
+    dbHelper.execute(sql, values).then(response => res.json(response), err => res.json(err))
   })
-  router.put('/:entity', authHelper.checkPermissions, (req, res) => {
+  router.put('/:entity', authHelper.checkPermissions.bind(authHelper), (req, res) => {
     let user
     if (req.session && req.session.user) {
       user = req.session.user
     }
-    const sql = dbHelper.buildUpdate(req.params.entity, req.query.where, req.body, user)
-    dbHelper.execute(sql).then(response => res.json(response), err => res.json(err))
+    const { sql, values } = dbHelper.buildUpdate(req.params.entity, req.query.where, req.body, user)
+    dbHelper.execute(sql, values).then(response => res.json(response), err => res.json(err))
   })
   return router
 }

package/dist/server/routes/v1/pdf.js

@@ -7,13 +7,11 @@ router.get('/', (req, res) => {
   // res.setHeader('Content-Disposition', 'attachment')
   // res.setHeader('filename', `${req.params.name || utils.createIdentity()}.pdf`)
   res.setHeader('Content-Disposition', `attachment;filename=${utils.createIdentity()}.pdf`)
-  res.contentType('application/pdf')
-  console.log(req.session.pdf)
+  res.contentType('application/pdf')  
   res.send(req.session.pdf)
 })
 
-router.post('/', (req, res) => {
-  console.log('creating pdf in wd')
+router.post('/', (req, res) => {  
   pdfHelper.createPDF(req.body, (err, pdf) => {
     if (err) {
       res.status(400)

package/dist/server/websy-designs-server.js

@@ -21,6 +21,7 @@ module.exports = function (options) {
     }
     const app = express()
     app.set('trust proxy', 1)
+    app.set('case sensitive routing', true)
     process.env.wdRoot = __dirname
     let version = options.version || 'v1'
     process.env.WD_VERSION = version
@@ -30,15 +31,12 @@ module.exports = function (options) {
     app.use(bodyParser.raw({limit: options.maxBodySize || '5mb'}))
     const AuthHelper = require(`./helpers/${version}/authHelper`)
     const NoAuthHelper = require(`./helpers/${version}/noAuthHelper`)
-    const allowCrossDomain = (req, res, next) => {
-      // console.log(req.url);
-      // const allowedOrigins = ['https://www.google.com', 'http://localhost:4000', 'https://localhost:4000', 'http://ec2-3-92-185-52.compute-1.amazonaws.com', 'https://ec2-3-92-185-52.compute-1.amazonaws.com']
+    const allowCrossDomain = (req, res, next) => {      
       let allowedOrigins = ['*']      
       if (process.env.ALLOWED_ORIGINS) {
         allowedOrigins = process.env.ALLOWED_ORIGINS.split(',')
       }
-      const origin = req.headers.origin
-      // console.log(allowedOrigins.indexOf(origin))
+      const origin = req.headers.origin      
       if (allowedOrigins.indexOf(origin) !== -1 || allowedOrigins[0] === '*') {        
         res.header('Access-Control-Allow-Origin', origin)
       }
@@ -55,31 +53,10 @@ module.exports = function (options) {
       }
       next()
     }  
-    // IMPLEMENT SESSION LOGIC HERE
     app.use(allowCrossDomain)
-    // app.use(
-    //   sanitizer.clean({
-    //     xss: true,
-    //     noSql: true,
-    //     sql: true
-    //   })
-    // )
-    app.get('/health', (req, res) => {
-      res.json('OK')
-    })
-    app.get('/environment', (req, res) => {
-      const env = {}
-      for (let key in process.env) {
-        if (key.substring(0, 7) === 'CLIENT_') {
-          env[key.substring(7)] = process.env[key]
-        }
-      }
-      res.json(env)
-    })    
     if (options.useRecaptcha === true && process.env.RECAPTCHA_SECRET) {
       app.use('/google', require(`./routes/${version}/recaptcha`))
-    }    
-    app.use('/pdf', require(`./routes/${version}/pdf`))
+    }        
     if (options.useDB === true) {            
       const dbHelper = require(`./helpers/${version}/${options.dbEngine}Helper`)
       let dbOptions = options.dbEngine === 'pg' ? options.dbOptions : options.dbOnError || {}
@@ -89,7 +66,7 @@ module.exports = function (options) {
         app.use(cookieParser(process.env.SESSION_SECRET))
         let cookieConfig = {
           maxAge: 7 * 24 * 60 * 60 * 1000,
-          httpOnly: false,
+          httpOnly: process.env.COOKIE_HTTPS === 'true' || process.env.COOKIE_HTTPS === true,
           domain: process.env.COOKIE_DOMAIN || 'localhost',
           secure: process.env.COOKIE_SECURE === 'true' || process.env.COOKIE_SECURE === true,
           sameSite: process.env.COOKIE_SAMESITE || 'none',
@@ -166,8 +143,8 @@ module.exports = function (options) {
             } 
             else {
               let excludedRoutes = process.env.EXCLUDED_ROUTES.split(',')              
-              if (secureRoutes === true) {
-                excludedRoutes.push('/resources', '/scripts', '/styles', '/external', '/templates', '/fonts')
+              if (secureRoutes === true) {                
+                excludedRoutes.push('/login')
               } 
               if (secureRoutes === false && excludedRoutes.indexOf('/' + req.path.split('/')[1]) !== -1) {                         
                 app.authHelper.isLoggedIn(req, res, next)
@@ -178,8 +155,6 @@ module.exports = function (options) {
               else {                
                 next()
               }
-              // secureRoutes === false && excludedRoutes.indexOf(req.path) !== -1 && app.authHelper.isLoggedIn(req, res, next)
-              // secureRoutes === true && excludedRoutes.indexOf(req.path) === -1 && app.authHelper.isLoggedIn(req, res, next)
             }            
           }
           else {
@@ -187,6 +162,16 @@ module.exports = function (options) {
           }         
         }
         app.use(protectedRoutes)
+        app.get('/environment', (req, res) => {
+          const env = {}
+          for (let key in process.env) {
+            if (key.substring(0, 7) === 'CLIENT_') {
+              env[key.substring(7)] = process.env[key]
+            }
+          }
+          res.json(env)
+        }) 
+        app.use('/pdf', require(`./routes/${version}/pdf`))
         if (options.useAPI === true) {          
           app.use('/api', sanitizer.clean(Object.assign({}, {
             xss: true,
@@ -194,6 +179,7 @@ module.exports = function (options) {
             sql: true,
             noSqlLevel: 2,
             sqlLevel: 2,
+            level: 2,
             allowedKeys: options.allowedKeys || []
           }, (dbOptions.sanitizeOptions || {}))), checkReferrer, protectedRoutes, require(`./routes/${version}/api`)(dbHelper, app.authHelper)) 
         }
@@ -237,6 +223,16 @@ module.exports = function (options) {
           next()
         }         
       }
+      app.use(protectedRoutes)
+      app.get('/environment', (req, res) => {
+        const env = {}
+        for (let key in process.env) {
+          if (key.substring(0, 7) === 'CLIENT_') {
+            env[key.substring(7)] = process.env[key]
+          }
+        }
+        res.json(env)
+      }) 
       resolve({app})
     }
   })  

package/dist/websy-designs-es6.debug.js

@@ -2836,7 +2836,7 @@ class MultiForm {
       `                   
       newFormEl.innerHTML = html
       el.appendChild(newFormEl)
-      let formOptions = Object.assign({}, this.options, { fields: [...this.options.fields.map(f => Object.assign({}, f))] })
+      let formOptions = Object.assign({}, this.options, { rowIndex: this.forms.length, fields: [...this.options.fields.map(f => Object.assign({}, f, { rowIndex: this.forms.length }))] })
       this.forms.push(new WebsyDesigns.Form(`${this.elementId}_${newId}_form`, formOptions))  
       if (addEl) {
         addEl.style.display = this.forms.length < this.options.maxRows ? 'flex' : 'none'
@@ -2924,7 +2924,17 @@ class MultiForm {
       el.innerHTML = html
       this.forms = new Array(this.formData.length)
       this.formData.forEach((d, i) => {
-        let formOptions = Object.assign({}, this.options, { fields: [...this.options.fields.map(f => Object.assign({}, f))] })
+        let formOptions = Object.assign({}, this.options, { 
+          rowIndex: i, 
+          fields: [...this.options.fields.map(f => {
+            const newF = Object.assign({}, f)
+            if (!newF.options) {
+              newF.options = {}
+            }
+            newF.options.rowIndex = i          
+            return newF
+          })]
+        })
         let formObject = new WebsyDesigns.Form(`${this.elementId}_${d.formId}_form`, formOptions)
         formObject.data = d
         this.forms[i] = formObject