@yarkivaev/scada 2.3.50 → 2.3.51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yarkivaev/scada",
-  "version": "2.3.50",
+  "version": "2.3.51",
   "description": "SCADA domain objects, state persistence, and plant monitoring",
   "repository": {
     "type": "git",

package/src/infrastructure/http/plant/allowedSegmentTags.js

@@ -0,0 +1,41 @@
+/**
+ * Normalizes a tags or options field that may be an array or JSON string.
+ *
+ * @param {unknown} raw - stored field
+ * @returns {Array<string>} id list
+ */
+function asIds(raw) {
+    if (Array.isArray(raw)) {
+        return raw.filter((id) => {
+            return typeof id === 'string';
+        });
+    }
+    if (typeof raw === 'string' && raw.length > 0) {
+        const parsed = JSON.parse(raw);
+        return asIds(parsed);
+    }
+    return [];
+}
+
+/**
+ * Returns whether requested tags are inside published options or already standing.
+ * Empty options mean no restriction so older publishers keep working.
+ *
+ * @param {unknown} options - published option ids
+ * @param {unknown} standing - tags already on the segment
+ * @param {unknown} tags - tags the operator wants to write
+ * @returns {boolean} true when every requested tag is allowed
+ * @example
+ *   allowedSegmentTags(['load'], [], ['load'])
+ */
+export default function allowedSegmentTags(options, standing, tags) {
+    const allow = asIds(options);
+    if (allow.length === 0) {
+        return true;
+    }
+    const held = new Set(asIds(standing));
+    const published = new Set(allow);
+    return asIds(tags).every((id) => {
+        return published.has(id) || held.has(id);
+    });
+}

package/src/infrastructure/http/plant/routes/timelineRoute.js

@@ -1,4 +1,5 @@
 import machineInPlant from '../../../../application/machineInPlant.js';
+import allowedSegmentTags from '../allowedSegmentTags.js';
 import segmentJson from '../json/segmentJson.js';
 import timelineOperator from '../timelineOperator.js';
 import { errorResponse, jsonResponse, readBody, route, sendRouteError } from '@yarkivaev/simple-server';
@@ -8,6 +9,18 @@ async function handleOperatorWrite(gate, parsed, write) {
     await write(audit);
 }
 
+async function rejectUnknownTags(timeline, parsed, machineId, res) {
+    if (typeof timeline.rowAt !== 'function') {
+        return false;
+    }
+    const row = await timeline.rowAt(new Date(parsed.start));
+    if (!row || allowedSegmentTags(row.options, row.tags, parsed.tags)) {
+        return false;
+    }
+    errorResponse('BAD_REQUEST', `Tag is not in segment options for ${machineId}`, 400).send(res);
+    return true;
+}
+
 async function respondToRequest(gate, timeline, requestId, req, res) {
     const raw = await readBody(req);
     const parsed = JSON.parse(raw);
@@ -61,6 +74,9 @@ export default function timelineRoute(basePath, plant, operatorOptions) {
             try {
                 const raw = await readBody(req);
                 const parsed = JSON.parse(raw);
+                if (await rejectUnknownTags(result.machine.timeline, parsed, params.machineId, res)) {
+                    return;
+                }
                 await handleOperatorWrite(gate, parsed, async (audit) => {
                     await result.machine.timeline.retag(new Date(parsed.start), parsed.tags, parsed.properties, audit);
                 });