@x47base/pocketbase-addon 0.1.0

package/features/field_json_schema.go

@@ -0,0 +1,92 @@
+package features
+
+import (
+	"crypto/sha256"
+	"encoding/json"
+	"errors"
+	"github.com/pocketbase/pocketbase/core"
+	"strings"
+	"sync"
+
+	"github.com/santhosh-tekuri/jsonschema/v6"
+)
+
+type schemaCache struct {
+	mu      sync.Mutex
+	entries map[[32]byte]*jsonschema.Schema
+}
+type inlineSchemaLoader struct{}
+
+func (inlineSchemaLoader) Load(string) (any, error) {
+	return nil, errors.New("external schema resources are disabled; use inline definitions")
+}
+
+func compileFieldSchema(app core.App, raw string) (*jsonschema.Schema, error) {
+	if len(raw) > 65536 {
+		return nil, errors.New("schema exceeds 64 KiB")
+	}
+	var value any
+	dec := json.NewDecoder(strings.NewReader(raw))
+	dec.UseNumber()
+	if err := dec.Decode(&value); err != nil {
+		return nil, errors.New("schema must be valid JSON")
+	}
+	if !json.Valid([]byte(raw)) {
+		return nil, errors.New("schema must be valid JSON")
+	}
+	if !boundedJSONDepth(value, 0) {
+		return nil, errors.New("schema nesting exceeds 64 levels")
+	}
+	app.Store().SetFunc("pb.jsonSchemaCache", func(old any) any {
+		if old != nil {
+			return old
+		}
+		return &schemaCache{entries: map[[32]byte]*jsonschema.Schema{}}
+	})
+	cache := app.Store().Get("pb.jsonSchemaCache").(*schemaCache)
+	key := sha256.Sum256([]byte(raw))
+	cache.mu.Lock()
+	defer cache.mu.Unlock()
+	if schema := cache.entries[key]; schema != nil {
+		return schema, nil
+	}
+	compiler := jsonschema.NewCompiler()
+	compiler.DefaultDraft(jsonschema.Draft2020)
+	compiler.UseLoader(inlineSchemaLoader{})
+	compiler.AssertFormat()
+	if err := compiler.AddResource("urn:pocketbase:field", value); err != nil {
+		return nil, err
+	}
+	schema, err := compiler.Compile("urn:pocketbase:field")
+	if err != nil {
+		return nil, err
+	}
+	if len(cache.entries) >= 64 {
+		for k := range cache.entries {
+			delete(cache.entries, k)
+			break
+		}
+	}
+	cache.entries[key] = schema
+	return schema, nil
+}
+func boundedJSONDepth(value any, depth int) bool {
+	if depth > 64 {
+		return false
+	}
+	switch v := value.(type) {
+	case map[string]any:
+		for _, item := range v {
+			if !boundedJSONDepth(item, depth+1) {
+				return false
+			}
+		}
+	case []any:
+		for _, item := range v {
+			if !boundedJSONDepth(item, depth+1) {
+				return false
+			}
+		}
+	}
+	return true
+}

package/features/field_scalar_extensions_test.go

@@ -0,0 +1,66 @@
+package features_test
+
+import (
+	"context"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/spink-dev/pocketbase-extension/features"
+	"testing"
+)
+
+func TestScalarExtensions(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+	for _, tc := range []struct {
+		field     core.Field
+		good, bad string
+	}{
+		{&features.ColorField{TextField: core.TextField{Name: "value"}}, "#AABBCCDD", "red"},
+		{&features.DateOnlyField{TextField: core.TextField{Name: "value"}}, "2024-02-29", "2025-02-29"},
+	} {
+		c := core.NewBaseCollection("extensions")
+		c.Fields.Add(tc.field)
+		r := core.NewRecord(c)
+		r.Set("value", tc.good)
+		if err := tc.field.ValidateValue(context.Background(), app, r); err != nil {
+			t.Fatal(err)
+		}
+		r.Set("value", tc.bad)
+		if err := tc.field.ValidateValue(context.Background(), app, r); err == nil {
+			t.Fatal("invalid value accepted")
+		}
+	}
+}
+
+func TestScalarExtensionsPersist(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	c := core.NewBaseCollection("scalar_extensions")
+	c.Fields.Add(&features.ColorField{TextField: core.TextField{Name: "color"}}, &features.DateOnlyField{TextField: core.TextField{Name: "day"}})
+	if err := app.Save(c); err != nil {
+		t.Fatal(err)
+	}
+	r := core.NewRecord(c)
+	r.Set("color", "#ABCDEF")
+	r.Set("day", "2024-02-29")
+	if err := app.Save(r); err != nil {
+		t.Fatal(err)
+	}
+	got, err := app.FindRecordById(c.Id, r.Id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.GetString("color") != "#abcdef" || got.GetString("day") != "2024-02-29" {
+		t.Fatal("value changed on persistence")
+	}
+	c, err = app.FindCollectionByNameOrId(c.Id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.Fields.GetByName("color").Type() != features.FieldTypeColor || c.Fields.GetByName("day").Type() != features.FieldTypeDateOnly {
+		t.Fatal("lost field types")
+	}
+}

package/features/files.go

@@ -0,0 +1,36 @@
+package features
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+	"image"
+	_ "image/gif"
+	_ "image/jpeg"
+	_ "image/png"
+	"io"
+	"strconv"
+)
+
+func registerDimensions(app core.App) {
+	app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+		if e.Request.URL.Query().Get("dimensions") != "1" {
+			return e.Next()
+		}
+		fs, err := e.App.NewFilesystem()
+		if err != nil {
+			return err
+		}
+		defer fs.Close()
+		fs.SetContext(e.Request.Context())
+		r, err := fs.GetReader(e.ServedPath)
+		if err == nil {
+			c, _, err := image.DecodeConfig(io.LimitReader(r, 256<<10))
+			r.Close()
+			if err == nil && c.Width > 0 && c.Height > 0 {
+				e.Response.Header().Set("X-Image-Width", strconv.Itoa(c.Width))
+				e.Response.Header().Set("X-Image-Height", strconv.Itoa(c.Height))
+				e.Response.Header().Add("Access-Control-Expose-Headers", "X-Image-Width, X-Image-Height")
+			}
+		}
+		return e.Next()
+	})
+}

package/features/filter_has_any_test.go

@@ -0,0 +1,81 @@
+package features_test
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	_ "github.com/spink-dev/pocketbase-extension/features"
+	"testing"
+)
+
+func TestHasAnyRecordFilter(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	c := core.NewAuthCollection("has_any_auth")
+	c.Fields.Add(&core.SelectField{Name: "roles", MaxSelect: 3, Values: []string{"a", "ab", "b"}})
+	if err := app.Save(c); err != nil {
+		t.Fatal(err)
+	}
+	r := core.NewRecord(c)
+	r.SetEmail("private@example.com")
+	r.SetPassword("1234567890")
+	r.Set("roles", []string{"a", "b"})
+	if err := app.Save(r); err != nil {
+		t.Fatal(err)
+	}
+	info := &core.RequestInfo{Auth: r}
+	for _, tc := range []struct {
+		rule string
+		want bool
+	}{{`hasAny(@request.auth.roles,"b","other") = true`, true}, {`hasAny(@request.auth.roles,"ab") = true`, false}, {`hasAny(@request.auth.roles,"b") = false`, false}} {
+		allowed, err := app.CanAccessRecord(r, info, &tc.rule)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if allowed != tc.want {
+			t.Fatalf("%s: %v", tc.rule, allowed)
+		}
+	}
+}
+
+func TestHasAnyNegativeMultiRelation(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	groups := core.NewBaseCollection("filter_groups")
+	groups.Fields.Add(&core.SelectField{Name: "roles", MaxSelect: 2, Values: []string{"normal", "banned"}})
+	if err := app.Save(groups); err != nil {
+		t.Fatal(err)
+	}
+	ids := []string{}
+	for _, role := range []string{"normal", "banned"} {
+		r := core.NewRecord(groups)
+		r.Set("roles", []string{role})
+		if err := app.Save(r); err != nil {
+			t.Fatal(err)
+		}
+		ids = append(ids, r.Id)
+	}
+	parents := core.NewBaseCollection("filter_parents")
+	parents.Fields.Add(&core.RelationField{Name: "groups", CollectionId: groups.Id, MaxSelect: 3})
+	if err := app.Save(parents); err != nil {
+		t.Fatal(err)
+	}
+	parent := core.NewRecord(parents)
+	parent.Set("groups", ids)
+	if err := app.Save(parent); err != nil {
+		t.Fatal(err)
+	}
+	rule := `hasAny(groups.roles,"banned") = false`
+	allowed, err := app.CanAccessRecord(parent, &core.RequestInfo{}, &rule)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if allowed {
+		t.Fatal("negative membership accepted mixed relations")
+	}
+}

package/features/generate_test.go

@@ -0,0 +1,72 @@
+package features_test
+
+import (
+	"encoding/json"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/spink-dev/pocketbase-extension/features"
+	"net/http/httptest"
+	"regexp"
+	"testing"
+)
+
+func TestCollectionGenerateField(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	c := core.NewBaseCollection("generated_values")
+	c.Fields.Add(&core.TextField{Name: "code", AutogeneratePattern: "[A-Z]{8}"}, &core.TextField{Name: "plain"})
+	if err := app.Save(c); err != nil {
+		t.Fatal(err)
+	}
+	admin, err := app.FindFirstRecordByData(core.CollectionNameSuperusers, "email", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	token, err := admin.NewAuthToken()
+	if err != nil {
+		t.Fatal(err)
+	}
+	features.Register(app)
+	r, err := apis.NewRouter(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := app.OnServe().Trigger(&core.ServeEvent{App: app, Router: r}); err != nil {
+		t.Fatal(err)
+	}
+	handler, err := r.BuildMux()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		field, token string
+		status       int
+	}{{"code", "", 401}, {"code", token, 200}, {"plain", token, 400}, {"id", token, 400}, {"missing", token, 400}} {
+		req := httptest.NewRequest("POST", "/api/adapter/collections/"+c.Id+"/fields/"+tc.field+"/generate", nil)
+		req.Header.Set("Authorization", tc.token)
+		w := httptest.NewRecorder()
+		handler.ServeHTTP(w, req)
+		if w.Code != tc.status {
+			t.Fatalf("%s: got %d want %d", tc.field, w.Code, tc.status)
+		}
+		if tc.status == 200 {
+			var result struct {
+				Value string `json:"value"`
+			}
+			if err := json.Unmarshal(w.Body.Bytes(), &result); err != nil {
+				t.Fatal(err)
+			}
+			if !regexp.MustCompile(`^[A-Z]{8}$`).MatchString(result.Value) {
+				t.Fatal("invalid generated value")
+			}
+		}
+	}
+	count, err := app.CountRecords(c.Id)
+	if err != nil || count != 0 {
+		t.Fatal("generation persisted a record", err)
+	}
+}

package/features/has_any_visibility_test.go

@@ -0,0 +1,62 @@
+package features_test
+
+import (
+	"encoding/json"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+	_ "github.com/spink-dev/pocketbase-extension/features"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+)
+
+func TestHasAnyPreservesEmailVisibility(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	c := core.NewAuthCollection("filter_visibility")
+	c.ListRule = types.Pointer("")
+	if err := app.Save(c); err != nil {
+		t.Fatal(err)
+	}
+	r := core.NewRecord(c)
+	r.SetEmail("private@example.com")
+	r.SetPassword("1234567890")
+	if err := app.Save(r); err != nil {
+		t.Fatal(err)
+	}
+	router, _ := apis.NewRouter(app)
+	handler, err := router.BuildMux()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, visible := range []bool{false, true} {
+		r.SetEmailVisibility(visible)
+		if err := app.Save(r); err != nil {
+			t.Fatal(err)
+		}
+		req := httptest.NewRequest("GET", "/api/collections/"+c.Id+"/records?filter="+url.QueryEscape(`hasAny(email,"private@example.com") = true`), nil)
+		w := httptest.NewRecorder()
+		handler.ServeHTTP(w, req)
+		if w.Code != 200 {
+			t.Fatalf("filter failed %d", w.Code)
+		}
+		var response struct {
+			TotalItems int `json:"totalItems"`
+		}
+		if err := json.Unmarshal(w.Body.Bytes(), &response); err != nil {
+			t.Fatal(err)
+		}
+		expected := 0
+		if visible {
+			expected = 1
+		}
+		if response.TotalItems != expected {
+			t.Fatal("email visibility bypass")
+		}
+	}
+}

package/features/json.go

@@ -0,0 +1,50 @@
+package features
+
+import (
+	"context"
+	"encoding/json"
+	validation "github.com/pocketbase/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"strings"
+)
+
+type JSONField struct {
+	core.JSONField
+	Schema string `form:"schema" json:"schema,omitempty"`
+}
+
+func init() { core.Fields[core.FieldTypeJSON] = func() core.Field { return &JSONField{} } }
+func (f *JSONField) ValidateSettings(ctx context.Context, app core.App, c *core.Collection) error {
+	if err := f.JSONField.ValidateSettings(ctx, app, c); err != nil {
+		return err
+	}
+	if f.Schema == "" {
+		return nil
+	}
+	_, err := compileFieldSchema(app, f.Schema)
+	return err
+}
+func (f *JSONField) ValidateValue(ctx context.Context, app core.App, r *core.Record) error {
+	if err := f.JSONField.ValidateValue(ctx, app, r); err != nil {
+		return err
+	}
+	if f.Schema == "" {
+		return nil
+	}
+	schema, err := compileFieldSchema(app, f.Schema)
+	if err != nil {
+		return validation.NewError("validation_json_schema", "Invalid field schema")
+	}
+	raw, _ := r.GetRaw(f.Name).(types.JSONRaw)
+	var value any
+	dec := json.NewDecoder(strings.NewReader(string(raw)))
+	dec.UseNumber()
+	if err := dec.Decode(&value); err != nil || !boundedJSONDepth(value, 0) {
+		return validation.NewError("validation_json_schema", "Invalid or excessively nested JSON value")
+	}
+	if err := schema.Validate(value); err != nil {
+		return validation.NewError("validation_json_schema", "Value does not match the field JSON schema")
+	}
+	return nil
+}

package/features/membership.go

@@ -0,0 +1,64 @@
+package features
+
+import (
+	"errors"
+	"github.com/ganigeorgiev/fexpr"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"reflect"
+	"strings"
+)
+
+func init() { search.TokenFunctions["hasAny"] = hasAny }
+func hasAny(resolve func(fexpr.Token) (*search.ResolverResult, error), args ...fexpr.Token) (*search.ResolverResult, error) {
+	if len(args) < 2 || len(args) > 33 {
+		return nil, errors.New("hasAny expects a value and 1 to 32 string constants")
+	}
+	if args[0].Type != fexpr.TokenIdentifier && args[0].Type != fexpr.TokenText {
+		return nil, errors.New("hasAny value must be a field or string")
+	}
+	value, err := resolve(args[0])
+	if err != nil {
+		return nil, err
+	}
+	params := dbx.Params{}
+	if err := concatUniqueParams(params, value.Params); err != nil {
+		return nil, err
+	}
+	identifiers := make([]string, 0, len(args)-1)
+	for _, arg := range args[1:] {
+		if arg.Type != fexpr.TokenText || len(arg.Literal) > 1024 {
+			return nil, errors.New("hasAny constants must be strings up to 1024 bytes")
+		}
+		r, err := resolve(arg)
+		if err != nil {
+			return nil, err
+		}
+		if err := concatUniqueParams(params, r.Params); err != nil {
+			return nil, err
+		}
+		identifiers = append(identifiers, r.Identifier)
+	}
+	buildExpression := func(v string) string {
+		return `EXISTS (SELECT 1 FROM json_each(CASE WHEN json_valid(` + v + `) THEN CASE WHEN json_type(` + v + `) = 'array' THEN ` + v + ` ELSE json_array(` + v + `) END ELSE json_array(` + v + `) END) AS pb_has_any WHERE pb_has_any.type = 'text' AND pb_has_any.value COLLATE BINARY IN (` + strings.Join(identifiers, ",") + `))`
+	}
+	result := &search.ResolverResult{Identifier: buildExpression(value.Identifier), Params: params, NullFallback: search.NullFallbackDisabled, AfterBuild: value.AfterBuild}
+	if value.MultiMatchSubQuery != nil {
+		result.MultiMatchSubQuery = value.MultiMatchSubQuery
+		result.MultiMatchSubQuery.ValueIdentifier = buildExpression(value.MultiMatchSubQuery.ValueIdentifier)
+		if err := concatUniqueParams(result.MultiMatchSubQuery.Params, params); err != nil {
+			return nil, err
+		}
+	}
+	return result, nil
+}
+
+func concatUniqueParams(dst, src dbx.Params) error {
+	for key, value := range src {
+		if old, ok := dst[key]; ok && !reflect.DeepEqual(old, value) {
+			return errors.New("duplicate filter parameter")
+		}
+		dst[key] = value
+	}
+	return nil
+}

package/features/register.go

@@ -0,0 +1,45 @@
+package features
+
+import (
+	"embed"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	random "github.com/pocketbase/pocketbase/tools/security"
+	"io/fs"
+)
+
+//go:embed ui/*.js
+var files embed.FS
+
+func Register(app core.App) {
+	registerDimensions(app)
+	registerDuplicate(app)
+	app.OnServe().Bind(&hook.Handler[*core.ServeEvent]{Id: "adapter.features", Func: func(e *core.ServeEvent) error {
+		bundle, err := fs.Sub(files, "ui")
+		if err != nil {
+			return err
+		}
+		e.UIExtensions = append(e.UIExtensions, core.UIExtension{Name: "adapter-features", FS: bundle})
+		e.Router.POST("/api/adapter/collections/{collection}/fields/{field}/generate", generate).Bind(apis.RequireSuperuserAuth())
+		return e.Next()
+	}})
+}
+func generate(e *core.RequestEvent) error {
+	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+	if err != nil {
+		return e.NotFoundError("Missing collection", err)
+	}
+	field, ok := collection.Fields.GetByName(e.Request.PathValue("field")).(*core.TextField)
+	if !ok || field.PrimaryKey || field.AutogeneratePattern == "" {
+		return e.BadRequestError("Field does not support generation", nil)
+	}
+	value, err := random.RandomStringByRegex(field.AutogeneratePattern)
+	if err != nil {
+		return e.BadRequestError("Unable to generate value", err)
+	}
+	if err := field.ValidatePlainValue(value); err != nil {
+		return e.BadRequestError("Generated value does not satisfy field constraints", err)
+	}
+	return e.JSON(200, map[string]string{"value": value})
+}

package/features/schema_test.go

@@ -0,0 +1,58 @@
+package features_test
+
+import (
+	"context"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/spink-dev/pocketbase-extension/features"
+	"testing"
+)
+
+func TestJSONFieldSchema(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	for _, tc := range []struct{ schema, good, bad string }{
+		{`{"const":9007199254740993}`, `9007199254740993`, `9007199254740992`},
+		{`{"type":"object","properties":{"count":{"type":"integer","minimum":1}},"required":["count"],"additionalProperties":false}`, `{"count":2}`, `{"count":0}`},
+		{`{"$defs":{"day":{"type":"string","format":"date"}},"$ref":"#/$defs/day"}`, `"2024-02-29"`, `"2025-02-29"`},
+	} {
+		c := core.NewBaseCollection("schema_test")
+		f := &features.JSONField{JSONField: core.JSONField{Name: "payload"}, Schema: tc.schema}
+		c.Fields.Add(f)
+		if err := f.ValidateSettings(context.Background(), app, c); err != nil {
+			t.Fatal(err)
+		}
+		r := core.NewRecord(c)
+		r.Set("payload", tc.good)
+		if err := f.ValidateValue(context.Background(), app, r); err != nil {
+			t.Fatal(err)
+		}
+		r.Set("payload", tc.bad)
+		if err := f.ValidateValue(context.Background(), app, r); err == nil {
+			t.Fatal("accepted schema violation")
+		}
+	}
+	for _, raw := range []string{`{"$ref":"file:///etc/passwd"}`, `{"$ref":"http://127.0.0.1/schema"}`, `{"type":"unknown"}`, `{} {}`} {
+		f := &features.JSONField{JSONField: core.JSONField{Name: "payload"}, Schema: raw}
+		if err := f.ValidateSettings(context.Background(), app, core.NewBaseCollection("schema_test")); err == nil {
+			t.Fatalf("accepted invalid/external schema: %s", raw)
+		}
+	}
+	c := core.NewBaseCollection("persist_schema")
+	c.Fields.Add(&features.JSONField{JSONField: core.JSONField{Name: "payload"}, Schema: `{"type":"integer"}`})
+	if err := app.Save(c); err != nil {
+		t.Fatal(err)
+	}
+	r := core.NewRecord(c)
+	r.Set("payload", `"text"`)
+	if err := app.Save(r); err == nil {
+		t.Fatal("persisted invalid data")
+	}
+	r.Set("payload", 42)
+	if err := app.Save(r); err != nil {
+		t.Fatal(err)
+	}
+}