backend-plus 2.5.2-betha.4 → 2.5.2-betha.41

package/for-client/chpass.jade

@@ -59,7 +59,8 @@ html(lang=lang)
           td#resultDiff
         tr
           td
-          td
+          td.actions
+            a(href="./menu")=msgs.chpass.cancel
             input(type="submit", value=msgs.chpass.button)
         each errorLine in (flash.error||[])
           tr(style={color:'red'})

package/for-client/my-menu.js

@@ -199,6 +199,7 @@ myOwn.wScreens.proc.result={
         }else{
             divResult.textContent = result;
             divResult.style.backgroundColor = '#9FA';
+            divResult.setAttribute('result','success');
         }
     },
     showGrid:function(result, divResult){
@@ -207,6 +208,8 @@ myOwn.wScreens.proc.result={
     showError:function(err, divResult){
         divResult.textContent = err.message;
         divResult.style.backgroundColor = 'orange';
+        divResult.setAttribute('result','error');
+
     },
     showDownloadUrl:function(result, divResult){
         divResult.innerHTML='';
@@ -483,6 +486,7 @@ myOwn.displayMainMenu = function(addrParams){
         if(mtv){
             if(location.href.match(/^.{0,8}localhost/)){
                 mtv.style.backgroundImage='repeating-linear-gradient(-45deg, #FF8, #FF8 8px, #DDD 8px, #DDD 16px)'
+                mtv.setAttribute('dev-mode',true);
                 mtv.title = 'Warning! Using system in localhost!'
             }
         }

package/for-client/my-tables.js

@@ -903,7 +903,7 @@ myOwn.ActionColumnGrid.prototype.td = function td(depot){
             actionNamesList.forEach(function(actionName){
             var actionDef = my.tableAction[actionName];
             if(grid.def.allow[actionName] && depot.allow[actionName] !== false){
-                var buttonAction=html.button({class:'table-button', "skip-enter":true}, [
+                var buttonAction=html.button({class:'table-button', "skip-enter":true, "bp-action":actionDef.alt}, [
                     html.img({src:actionDef.img, alt:actionDef.alt, title:my.messages[actionDef.titleMsg]})
                 ]).create();
                 thActions.appendChild(buttonAction);
@@ -1983,7 +1983,7 @@ myOwn.TableGrid.prototype.prepareGrid = function prepareGrid(){
         });
     }
     if(grid.def.allow.insert && !grid.def.forInsertOnlyMode){
-        buttonInsert=html.button({class:'table-button', "enter-clicks":true}, [
+        buttonInsert=html.button({class:'table-button', "enter-clicks":true, "bp-action": "INS"}, [
             html.img({
                 src:my.path.img+'insert.png',
                 alt:'INS',
@@ -2203,6 +2203,9 @@ myOwn.specialDefaultValue={
         return belowDepot.row[fieldName]?belowDepot.row[fieldName]+1:(
             aboveDepot.row[fieldName]?aboveDepot.row[fieldName]-1:1
         ); 
+    },
+    current_user: function specialDefaultValueCurrentUser(){
+        return my.config.username;
     }
 }
 
@@ -2309,7 +2312,7 @@ myOwn.TableGrid.prototype.displayGrid = function displayGrid(){
     grid.updateRowData = function updateRowData(depot, skipUpdateStatus){
         var grid = this;
         var forInsert = false; // not define how to detect
-        var tr = depot;
+        var tr = depot.tr;
         grid.setRowStyle(depot,depot.row, skipUpdateStatus);
         grid.def.fields.filter(function(fieldDef){
             return fieldDef.visible;
@@ -2341,6 +2344,12 @@ myOwn.TableGrid.prototype.displayGrid = function displayGrid(){
             depot.clientSidePrepared=true;
             grid.my.clientSides[grid.def.clientSide].update(depot);
         }
+        if (depot.allow.update) {
+            tr.setAttribute('can-update','yes')
+        }
+        if (depot.allow.delete) {
+            tr.setAttribute('can-delete','yes')
+        }
     };
     var saveRow = function(depot, opts){
         if(!('saving' in depot)){
@@ -2490,7 +2499,7 @@ myOwn.TableGrid.prototype.displayGrid = function displayGrid(){
                         }
                     }
                 }
-            }else if(!/^\$allow\./.test(fieldName)){
+            }else if(/^\$allow\./.test(fieldName)){
                 depot.allow[fieldName.replace(/^\$allow\./,'')] = retrievedRow[fieldName];
             }
         }
@@ -2708,7 +2717,7 @@ myOwn.TableGrid.prototype.displayGrid = function displayGrid(){
             if(iRow<depotsToDisplay.length){
                 var addButtonRest = function addButtonRest(toNextRowNumber){
                     var createRestButtonInto = function(domElement){
-                        var buttonRest=html.button({class:'foot-info', "enter-clicks":true},"+..."+toNextRowNumber).create();
+                        var buttonRest=html.button({class:'foot-info', "enter-clicks":true, "all-rows-displayed": "no"},"+..."+toNextRowNumber).create();
                         domElement.appendChild(html.span('  ').create());
                         domElement.appendChild(buttonRest);
                         return buttonRest;
@@ -2738,6 +2747,7 @@ myOwn.TableGrid.prototype.displayGrid = function displayGrid(){
                 if(grid.dom.buttonInsert){
                     grid.dom.buttonInsert.style.visibility='visible';
                 }
+                grid.dom.headInfo.rowCount.setAttribute("all-rows-displayed", "yes")
             }
         };
         var linesToDisplay=(

package/for-client/my-things.js

@@ -322,6 +322,7 @@ myOwn.insertRow = function insertRow(where){
             where.smooth={};
         }
         var trDummy = section.insertRow(iRow);
+        trDummy.setAttribute('dummy','inserting')
         tr.style.display='none';
         for(var i=0; i<(where.smooth.colCount||1); i++){
             var cell=trDummy.insertCell(-1);

package/lib/backend-plus.d.ts

@@ -56,6 +56,7 @@ export interface ProcedureDef<T = any> {
     forExport?:{
         fileName?:string
         csvFileName?:string
+        generarInmediato?:boolean
     }
 }
 
@@ -172,10 +173,14 @@ export type SequenceDefinition = {
     name:string
     firstValue:number
     prefix?:string /* Prefix for the generated value */
+} 
+export type SequenceMadMaxDefinition = {
+    madMax: string[] // grouping of mad max sequences
+    firstValue?: number
 }
 export type ExportMetadataDefinition={ /* TODO: define */ }
 export type PostInputOptions='upperSpanish' | 'upperWithoutDiacritics' | 'parseDecimal'
-export type FieldDefinition = EditableDbDefinition & {
+export interface FieldDefinition extends EditableDbDefinition {
     name:string
     typeName:PgKnownTypes|'ARRAY:text'
     label?:string
@@ -184,8 +189,9 @@ export type FieldDefinition = EditableDbDefinition & {
     dbNullable?:boolean        /* dbNullable === false is not nullabla at DB level, but not at CLIENT LEVEL */
     defaultValue?:any
     defaultDbValue?:PgKnownDbValues|string
+    specialDefaultValue?:string /* keyof myOwn.specialDefaultValues and/or keyof AppBackend.prototype.specialSqlDefaultExpressions */
     clientSide?:string         /* keyof: myOwn.clientSides */
-    isName?:boolean
+    isName?:boolean|'known'    /* is a name but it is a well known name (because the user uses it to thier code or because the code is enugh expresive)
     isPk?:number               /* internal: pos in the primaryKey array */
     serverSide?:boolean        /* default:!clientSide if the value is retrived from the database */
     inTable?:boolean           /* default:!clientSide && !sql.fields[...].expr. Is a real fisical field in the table */
@@ -200,7 +206,6 @@ export type FieldDefinition = EditableDbDefinition & {
     references?:string         /* table name */ 
     referencesField?:string  
     aggregate?:'avg'|'sum'|'count'|'min'|'max'|'countTrue'          /* keyof myOwn.TableAggregates */
-    specialDefaultValue?:string /* keyof myOwn.specialDefaultValues
     defaultForOtherFields?:boolean   /* the field that stores the "other fields" of a flexible imported table */
     specialValueWhenInsert?:string 
     exportMetadata?:ExportMetadataDefinition 
@@ -218,12 +223,9 @@ export type FieldDefinition = EditableDbDefinition & {
     alwaysShow?:boolean /* show when appears in fixed fields */
     suggestingKeys?:string[]
     postInput?:PostInputOptions
-} & ({} | {
-    sequence:SequenceDefinition
-    nullable:true
-    editable:false
-})
-export type EditableDbDefinition = {
+    sequence?: SequenceDefinition|SequenceMadMaxDefinition
+}
+export interface EditableDbDefinition {
     editable?:boolean
     allow?:{
         update?:boolean
@@ -240,13 +242,15 @@ export type FieldsForConnect = (string | {source:string, target:string})[]
 export type FieldsForConnectDetailTable = (string | {source:string, target:string, nullMeansAll?:boolean} | {value:any, target:string})[]
 
 export type FkActions = 'no action'|'restrict'|'cascade'|'set null'|'set default';
-export type ForeignKey = {
+export interface ForeignKey {
     references:string, 
     fields:FieldsForConnect, 
     onUpdate?: FkActions, 
     onDelete?: FkActions, 
     displayAllFields?: boolean, 
-    alias?:string, 
+    alias?:string,
+    abr?:string,
+    label?:string,
     displayFields?:string[], 
     consName?:string, 
     initiallyDeferred?:boolean
@@ -395,7 +399,9 @@ export interface AppConfigServer
         "kill-9": string                   // a way to kill from URL with a token
         bitacoraSchema: string
         bitacoraTableName: string 
-        allowedHosts:string[]              //API allowed hosts
+        useCors: boolean                   //habilita Cross-Origin Resource Sharing
+        allowedHosts:string[]              //determina API allowed hosts (necesita habilitar useCors)
+        policy?:string
     }
 export interface AppConfigDb 
     {
@@ -432,6 +438,9 @@ export interface AppConfigLogin
             store:{
                 module: string
             }
+            successRedirect: string // where to redirect after login
+            failureRedirect: string // where to redirect after login failure
+            failedLoginUrlPath: string // where to redirect after a failed login
         }
         forget: {                          // forget password configurations:
             urlPath: string                // url sent by mail. default: `/new-pass`
@@ -501,6 +510,7 @@ export interface AppConfig {
             results: boolean               // if query results must be included in full db logs
         }
         session: boolean                   // if all session activity must be logged
+        "pass-migration"?: boolean
     }
     devel: {
         delay: number                      // msec avg random delay in API responses (to emulate slow nets)
@@ -544,6 +554,7 @@ export class AppBackend{
     dbUserNameExpr:string
     dbUserRolExpr:string
     specialValueWhenInsert:{[k:string]:(context:ProcedureContext, defField:FieldDefinition, parameters:object)=>any}
+    specialSqlDefaultExpressions:Record<string, string>
     clearCaches():void
     start(opts?: StartOptions):Promise<void>
     getTables():TableItemDef[]
@@ -582,7 +593,7 @@ export class AppBackend{
         messages:Record<LangId,Record<string, string>>
     }
     shutdownCallbackListAdd(param:{message:string, fun:()=>Promise<void>}):void
-    shutdownBackend():Promise<void>
+    shutdownBackend(opts?:{skipTurnOff?:boolean, onlyTurnOff?:boolean}):Promise<void>
     setLog(opts:{until:string, results?:boolean}):void
     getDataDumpTransformations(rawData:string):Promise<{rawData:string, prepareTransformationSql:string[], endTransformationSql:string[]}>
 }

package/lib/backend-plus.js

@@ -20,6 +20,7 @@ MiniTools.globalOpts.serveErr.propertiesWhiteList=['message','detail','code','ta
 var crypto = require('crypto');
 var serveContent = require('serve-content');
 var pg = require('pg-promise-strict');
+var pgTriggers = require('pg-triggers');
 var SessionFileStore = require('session-file-store');
 var memorystore = require('memorystore');
 var jsToHtml=require('js-to-html');
@@ -82,7 +83,159 @@ function md5(text){
     return crypto.createHash('md5').update(text).digest('hex');
 }
 
-//
+const DEFAULT_ITERATIONS = 4096; 
+const HASH_ALGORITHM = 'sha256';
+
+// primera version de scram sha 256. El Verifier completo tenía 64 bytes.
+const LEGACY_KEY_LENGTH = 64; 
+
+// Formato nuevo/PG-Compatible: El Client Key tiene 32 bytes (SHA-256).
+const SCRAM_KEY_LENGTH = 32; 
+
+const bufferToBase64 = (buffer) => buffer.toString('base64');
+
+/**
+ * Función central para PBKDF2 (Acepta KEY_LEN para compatibilidad).
+ * Devuelve la clave derivada con la longitud especificada.
+ */
+async function deriveKey(password, saltBuffer, iterations, keyLength) { 
+    return new Promise((resolve, reject) => {
+        crypto.pbkdf2(
+            password, 
+            saltBuffer,
+            iterations, 
+            keyLength,
+            HASH_ALGORITHM, 
+            (err, derivedKey) => {
+                if (err) return reject(err);
+                resolve(derivedKey); 
+            }
+        );
+    });
+}
+
+async function generateScramVerifier(password) {
+    const saltBuffer = crypto.randomBytes(16); 
+    const saltBase64 = bufferToBase64(saltBuffer);
+
+    const Hi = await deriveKey(
+        password, 
+        saltBuffer, 
+        DEFAULT_ITERATIONS,
+        SCRAM_KEY_LENGTH 
+    );
+    const clientKey = crypto.createHmac('sha256', Hi).update('Client Key').digest();
+    const serverKey = crypto.createHmac('sha256', Hi).update('Server Key').digest();
+
+    const storedKey = crypto.createHash('sha256').update(clientKey).digest();
+
+    const storedKeyBase64 = bufferToBase64(storedKey);
+    const serverKeyBase64 = bufferToBase64(serverKey);
+
+    return `SCRAM-SHA-256$${DEFAULT_ITERATIONS}:${saltBase64}$${storedKeyBase64}:${serverKeyBase64}`;
+}
+
+/**
+ * Verifica una contraseña contra el hash SCRAM PG-Compatible.
+ * Formato PG: SCRAM-SHA-256$<iteraciones>:<Salt>$<StoredKey>:<ServerKey>
+ * @param {string} password - Contraseña en texto plano.
+ * @param {string} storedScramString - Cadena SCRAM de PostgreSQL.
+ * @returns {Promise<boolean>} True si la contraseña es válida.
+ */
+async function verifyScramPG(password, storedScramString) {
+    if (!storedScramString.startsWith('SCRAM-SHA-256$')) {
+        return false;
+    }
+    
+    const parts = storedScramString.split('$');
+    if (parts.length !== 3) {
+        return false;
+    }
+        
+    const [storedIterations, saltBase64] = parts[1].split(':');
+    const [storedKeyBase64, serverKeyBase64] = parts[2].split(':'); // Asume StoredKey y ServerKey
+
+    if (!saltBase64 || !storedKeyBase64 || !serverKeyBase64 || isNaN(parseInt(storedIterations))) {
+        return false;
+    }
+    
+    const iterations = parseInt(storedIterations);
+    const saltBuffer = Buffer.from(saltBase64, 'base64');
+    const storedKeyBuffer = Buffer.from(storedKeyBase64, 'base64');
+    const serverKeyBuffer = Buffer.from(serverKeyBase64, 'base64');
+
+    const Hi = await deriveKey(
+        password, 
+        saltBuffer, 
+        iterations,
+        SCRAM_KEY_LENGTH
+    );
+
+    const clientKey = crypto.createHmac(HASH_ALGORITHM, Hi)
+        .update('Client Key')
+        .digest();
+
+    const serverKeyActual = crypto.createHmac(HASH_ALGORITHM, Hi)
+        .update('Server Key')
+        .digest();
+
+    const storedKeyActual = crypto.createHash('sha256').update(clientKey).digest();
+
+    const storedKeyMatch = crypto.timingSafeEqual(storedKeyActual, storedKeyBuffer);
+    const serverKeyMatch = crypto.timingSafeEqual(serverKeyActual, serverKeyBuffer);
+    return storedKeyMatch && serverKeyMatch;
+}
+
+/**
+ * Verifica una contraseña contra el hash SCRAM Legacy (64 bytes).
+ * Formato Legacy: SCRAM-SHA-256$<iteraciones>:<Salt>$<Verifier(64 bytes)>
+ * @param {string} password - Contraseña en texto plano.
+ * @param {string} storedScramString - Cadena SCRAM Legacy.
+ * @returns {Promise<boolean>} True si la contraseña es válida.
+ */
+async function verifyScramLegacy(password, storedScramString) {
+    if (!storedScramString.startsWith('SCRAM-SHA-256$')) {
+        // No es formato SCRAM. Debe ser MD5 u otro algoritmo.
+        return false;
+    }
+
+    // Parsea la cadena SCRAM
+    // Ejemplo: SCRAM-SHA-256$4096:SALT_BASE64$VERIFIER_BASE64
+    const parts = storedScramString.split('$');
+    if (parts.length !== 3) {
+        throw new Error('Formato SCRAM almacenado inválido.');
+    }
+        
+    // Obtiene iteraciones y salt de la segunda parte (ej: '4096:SALT_BASE64')
+    const [storedIterations, storedSalt] = parts[1].split(':');
+    const storedVerifier = parts[2];
+    
+    if (!storedSalt || !storedVerifier || isNaN(parseInt(storedIterations))) {
+        throw new Error('Datos de SCRAM incompletos o malformados.');
+    }
+    
+    const iterations = parseInt(storedIterations);
+
+    // Deriva la clave de la contraseña ingresada
+    const generatedVerifierBuffer = await deriveKey(
+        password, 
+        storedSalt, 
+        iterations,
+        LEGACY_KEY_LENGTH
+    );
+    const generatedVerifier = bufferToBase64(generatedVerifierBuffer);
+
+    // Compara de manera segura contra el Verificador Almacenado
+    const storedVerifierBuffer = Buffer.from(storedVerifier, 'base64');
+    const generatedVerifierBufferFromBase64 = Buffer.from(generatedVerifier, 'base64');
+
+    // Usa crypto.timingSafeEqual para evitar ataques de temporización
+    if (generatedVerifierBufferFromBase64.length !== storedVerifierBuffer.length) {
+        return false;
+    }
+
+    return crypto.timingSafeEqual(generatedVerifierBufferFromBase64, storedVerifierBuffer);
+}
 
 var dist=regexpDistCheck.test(packagejson.main)?'dist/':'';
 
@@ -235,12 +388,13 @@ AppBackend.prototype.i18n.messages.en={
                 button: "Sign In"
         },
         chpass:{
-                title: 'change password',
-                username: 'Username',
-                oldPassword:'Old password',
-                newPassword:'New password',
-                repPassword:'Reenter password',
-                button:'Change',
+            title: 'change password',
+            username: 'Username',
+            oldPassword:'Old password',
+            newPassword:'New password',
+            repPassword:'Reenter password',
+            button:'Change',
+            cancel: 'Cancel'
         },
         fileUploaded:'file uploaded',
         unkownExt:'unkown file extension'
@@ -315,12 +469,13 @@ AppBackend.prototype.i18n.messages.es={
     },
     logged:{
         chpass:{
-                title: 'cambio de clave',
-                username: 'usuario',
-                oldPassword:'clave anterior',
-                newPassword:'nueva clave',
-                repPassword:'repetir nueva clave',
-                button:'Cambiar',
+            title: 'cambio de clave',
+            username: 'usuario',
+            oldPassword:'clave anterior',
+            newPassword:'nueva clave',
+            repPassword:'repetir nueva clave',
+            button:'Cambiar',
+            cancel: 'Cancelar'
         },
         fileUploaded:'archivo subido',
         unkownExt:'extensión de archivo desconocida'
@@ -521,14 +676,14 @@ AppBackend.prototype.shutdownCallbackListAdd = function(messageFun){
 
 
 AppBackend.prototype._Browsers = {
-    Edge:      {short:'Ed'  , minVer:14  , polly:true},
+    Edge:      {short:'Ed'  , minVer:14  , polly:117},
     Konqueror: {short:'Kq'  , minVer:null, polly:true},
-    Chromium:  {short:'Chmm', minVer:49  , polly:58  },
-    Chrome:    {short:'Ch'  , minVer:49  , polly:58  },
-    Safari:    {short:'Sf'  , minVer:9   , polly:9   },
+    Chromium:  {short:'Chmm', minVer:49  , polly:117},
+    Chrome:    {short:'Ch'  , minVer:49  , polly:117},
+    Safari:    {short:'Sf'  , minVer:9   , polly:17},
     IE:        {short:'IE'  , minVer:11  , polly:true},
     Opera:     {short:'Op'  , minVer:null, polly:true},
-    Firefox:   {short:'FF'  , minVer:52  , polly:52  },
+    Firefox:   {short:'FF'  , minVer:52  , polly:119},
 };
 
 var fontExts = [ 'jfproj', 'ttf', 'pfa', 'woff', 'woff2', 'fnt', 'fot', 'otf', 'odttf', 'fon']
@@ -642,33 +797,42 @@ AppBackend.prototype.start = function start(opts){
         // @ts-ignore : only for testing */
         this.getMainApp = function getMainApp(){ return mainApp; };
     }
-    this.shutdownBackend = async function shutdownBackend(){
-        console.log('shooting down:');
-        var waitFor = [
-            new Promise(function(resolve,reject){
-                console.log('*','express server');
-                be.server.close(/** @param {Error} err */function(err){
-                    if(err){
-                        console.log('*', err)
-                        reject(err);
-                    }else{
-                        console.log('*','express server done!')
-                        resolve();
-                    }
-                });
-            }),
-            ...(be.shutdownCallbackList.map(x => (async function(){
-                console.log('shut:', x.message)
-                await x.fun()
-                console.log('done:', x.message)
-            })()))
-        ];
-        console.log('*', 'waiting for all')
-        await Promise.all(waitFor);
-        console.log('*', 'all done')
-        mainApp = null;
-        console.log('* logWhy',logWhy)
-        logWhy && logWhy();
+    this.shutdownBackend = async function shutdownBackend(opts){
+        var shootingDown = opts == null || !opts.onlyTurnOff;
+        var turningOff = opts == null || !opts.skipTurnOff;
+        if(!shootingDown){
+            console.log('shooting down:');
+            var waitFor = [
+                new Promise(function(resolve,reject){
+                    console.log('*','express server');
+                    be.server.close(/** @param {Error} err */function(err){
+                        if(err){
+                            console.log('*', err)
+                            reject(err);
+                        }else{
+                            console.log('*','express server done!')
+                            resolve();
+                        }
+                    });
+                }),
+                ...(be.shutdownCallbackList.map(x => (async function(){
+                    console.log('shut:', x.message)
+                    await x.fun()
+                    console.log('done:', x.message)
+                })())),
+            ];
+            console.log('*', 'waiting for all')
+            await Promise.all(waitFor);
+            console.log('*', 'all done')
+            mainApp = null;
+        }
+        if(turningOff){
+            console.log('turning off:');
+            await pg.shutdown();
+            console.log('pg shutdown done!');
+            console.log('* logWhy',logWhy)
+            logWhy && logWhy();
+        }
     };
     return Promise.resolve().then(function(){
         var configList=be.configList();
@@ -704,6 +868,9 @@ AppBackend.prototype.start = function start(opts){
                     }
                     var storeModule = be.sessionStores[sessionStoreName];
                     be.config.login.plus.store.module = storeModule;
+                }else{
+                    console.error('###################### DEPRECATED #####################')
+                    console.error('LACK OF server.session-store')
                 }
                 be.config.install.dump.db.owner=coalesce(be.config.db.owner,be.config.install.dump.db.owner,be.config.db.user);
                 be.config.install.dump.db["owner4special-scripts"]=coalesce(be.config.install.dump.db["owner4special-scripts"],be.config.install.dump.db.owner)
@@ -801,7 +968,7 @@ AppBackend.prototype.start = function start(opts){
                             }
                         }).then(function(client){
                             if(username){
-                                return client.query(`SELECT set_app_user(${be.db.quoteLiteral(username)})`).execute().then(function(){
+                                return client.query(`CALL set_app_user(${be.db.quoteLiteral(username)})`).execute().then(function(){
                                     return client;
                                 });
                             }else{
@@ -903,18 +1070,23 @@ AppBackend.prototype.start = function start(opts){
     }).then(async function(){
         mainApp = express();
         //mainApp.use(cookieParser());
-        const whitelist = ['localhost'].concat(be.config.server.allowedHosts||[]); // Agrega aquí los orígenes de tus aplicaciones
-        const corsOptions = {
-            origin: function (origin, callback) {
-                if (whitelist.some((element)=>origin?.includes(element)) || !origin){
-                    callback(null, true);
-                }else{
-                    callback(new Error('Not allowed by CORS'));
-                }
-            },
-            credentials: true
-        };
-        mainApp.use(cors(corsOptions));
+        if(be.config.server.allowedHosts){
+            if(!Array.isArray(be.config.server.allowedHosts)){
+                throw Error('allowedHosts must be an Array')
+            }
+            const whitelist = ['localhost'].concat(be.config.server.allowedHosts);
+            const corsOptions = {
+                origin: function (origin, callback) {
+                    if (whitelist.some((element)=>origin?.includes(element)) || !origin){
+                        callback(null, true);
+                    }else{
+                        callback(new Error('Not allowed by CORS'));
+                    }
+                },
+                credentials: true
+            };
+            mainApp.use(cors(corsOptions));
+        }
         mainApp.use(bodyParser.urlencoded({extended:true, limit: '50mb'}));
         mainApp.use(function(req,res,next){
             if((req.headers['content-type']||'').match(/^multipart\/form-data/)){
@@ -931,8 +1103,11 @@ AppBackend.prototype.start = function start(opts){
         });
         if(be.config.log.req){
             mainApp.use(function(req,res,next){
-                if(!/keep-alive.json$/.test(req.originalUrl) || be.config.log.req['keep-alive']){
-                    console.log('REQ',req.method,req.protocol,req.hostname,req.originalUrl,'from:',req.ip);
+                if(
+                    (!/keep-alive.json$/.test(req.originalUrl) || be.config?.log?.req?.['keep-alive']) &&
+                    (!/(.png|.jpg|.js|.jsx|.css|.html)$/.test(req.originalUrl) || be.config?.log?.req?.['all'])
+                ){
+                    console.log('REQ',req.method,req.protocol,req.hostname,req.originalUrl,'from:',req.ip,req.query);
                 }
                 next();
             });
@@ -1007,41 +1182,110 @@ AppBackend.prototype.start = function start(opts){
                     mainApp.loginPlusManager.closeManager();
                 }
             });
-            be.shutdownCallbackListAdd({
-                message:'pg',
-                fun:function(){
-                    pg.shutdown();
+            const updatePassword = async ({client, username, password, setUpdateDate, errorIfNoResult}) => {
+                const {table, passFieldName, userFieldName, passUpdatedAtFieldName, passAlgorithmFieldName, schema} = be.config.login;                
+                const hashPass = await generateScramVerifier(password);
+                let params = [username, hashPass];
+                let setters = [`${be.db.quoteIdent(passFieldName)} = $2`];
+                if(passAlgorithmFieldName){
+                    setters.push(`${be.db.quoteIdent(passAlgorithmFieldName)} = $3`);
+                    params.push('PG-SHA256')
                 }
-            });
+                if(setUpdateDate && passUpdatedAtFieldName){
+                    setters.push(`${be.db.quoteIdent(passUpdatedAtFieldName)} = current_timestamp`)
+                }
+                        
+                const result = await client.query(`
+                    UPDATE ${(schema ? be.db.quoteIdent(schema) + '.' : '') + be.db.quoteIdent(table)} 
+                        SET ${setters.join(', ')}
+                        WHERE ${be.db.quoteIdent(userFieldName)} = $1
+                        returning 1 as ok
+                    `, params
+                ).fetchOneRowIfExists();
+
+                if(result.rowCount === 0 && errorIfNoResult){
+                    throw Error ('no se encontró el usuario')
+                };
+                return result
+            }
             mainApp.loginPlusManager.setValidatorStrategy(
-                function(req, username, password, done) {
-                    var client;
-                    if(!be.config.login["preserve-case"]){
-                        username = username.toLowerCase().trim();
-                    }
-                    be.getDbClient(req).then(function(cli){
-                        client = cli;
-                        return client.query("select set_app_user('!login')").execute();
-                    }).then(function(){
-                        var infoFieldList=be.config.login.infoFieldList||(be.config.login.rolFieldName?[be.config.login.userFieldName,be.config.login.rolFieldName]:[be.config.login.userFieldName]);
-                        return client.query(
-                            "SELECT  "+infoFieldList.map(function(fieldOrPair){ return fieldOrPair.split(' as ').map(function(ident){ return be.db.quoteIdent(ident)}).join(' as '); })+
+                async function(req, username, password, done) {
+                    try{
+                        var client;
+                        if(!be.config.login["preserve-case"]){
+                            username = username.toLowerCase().trim();
+                        }
+                        client = await be.getDbClient(req);
+                        await client.query("CALL set_app_user('!login')").execute();
+                        const {passFieldName, rolFieldName, userFieldName} = be.config.login;
+                        var infoFieldList=(
+                            be.config.login.infoFieldList||(
+                                rolFieldName?
+                                    [userFieldName, rolFieldName]
+                                :
+                                    [userFieldName]
+                                )
+                            ).concat(passFieldName);
+                        
+                        const sql = "SELECT  "+infoFieldList.map(function(fieldOrPair){ return fieldOrPair.split(' as ').map(function(ident){ return be.db.quoteIdent(ident)}).join(' as '); })+
                                 ", "+be.config.login.activeClausule+" as active "+
                                 ", "+be.config.login.lockedClausule+" as locked "+
                             "  FROM  "+(be.config.login.from ?? (
                                 (be.config.login.schema?be.db.quoteIdent(be.config.login.schema)+'.':'')+
                                 be.db.quoteIdent(be.config.login.table)
                             ))+
-                            "  WHERE "+be.db.quoteIdent(be.config.login.userFieldName)+" = $1 "+
-                            "    AND "+be.db.quoteIdent(be.config.login.passFieldName)+" = $2 ",
-                            [username, md5(password+username)]
-                        ).fetchOneRowIfExists();
-                    }).then(function(data){
+                            "  WHERE "+be.db.quoteIdent(be.config.login.userFieldName)+" = $1 ";
+                        const data = await client.query(sql,[username]).fetchOneRowIfExists();
+
+                        if(data.rowCount != 1){
+                            done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
+                            return
+                        }else{
+                            let needsMigration = false;
+                            const user = data.row;
+                            if(!user[passFieldName]){
+                                done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
+                                return
+                            }
+                            const usaScramSha256 = user[passFieldName].startsWith('SCRAM-SHA-256$')
+                            if (usaScramSha256){
+                                let isScramValid = false;
+                                // 1. Intento con formato PG-Compatible (Nuevo)
+                                if(await verifyScramPG(password, user[passFieldName])){
+                                    isScramValid = true;
+                                }
+                                
+                                // 2. Intento con formato Legacy (64 bytes)
+                                else if(await verifyScramLegacy(password, user[passFieldName])){
+                                    isScramValid = true;
+                                    needsMigration = true;
+                                }
+                                if(!isScramValid){
+                                    done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
+                                    return
+                                }
+                            }else{                         
+                                if (md5(password+username.toLowerCase()) === user[passFieldName]){
+                                    needsMigration = true;
+                                }else{
+                                    done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
+                                    return
+                                }
+                            }
+                            if(needsMigration){
+                                if (be.config.log["pass-migration"]) console.log('Ejecutando migración a SCRAM...');
+                                await updatePassword({client, username, password, setUpdateDate:false, errorIfNoResult:true});
+                                if (be.config.log["pass-migration"]) console.log('Migración completada.');
+                            }
+                        }
+                        //continua validando                    
                         if(data.rowCount==1){
                             if(!data.row.active){
                                 done(null,false,{message:be.messages.unlogged.login.inactiveFail});
+                                return
                             }else if(data.row.locked){
                                 done(null,false,{message:be.messages.unlogged.login.lockedFail});
+                                return
                             }else{
                                 if(req.query["return-to"]){
                                     req.session.loginReturnTo = req.query["return-to"];
@@ -1049,12 +1293,13 @@ AppBackend.prototype.start = function start(opts){
                                 if(be.config.login["double-dragon"]){
                                     be.DoubleDragon.dbParams[username] = changing(be.config.db, {user:username, password});
                                 }
-                                return data.row;
                             }
                         }else{
                             done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
+                            return
                         }
-                    }).then(async function(userInfo){
+
+                        const userInfo = data.row;
                         if (!userInfo) return;
                         if (!be.config.login.skipBitacora) {
                             var context = be.getContext(req);
@@ -1069,56 +1314,73 @@ AppBackend.prototype.start = function start(opts){
                             userInfo.bitacoraId = sessionInfo.value;
                         }
                         done(null, userInfo);
-                    }).then(function(){
-                        client.done();
-                    }).catch(function(err){
+                    }catch(err){
                         if(be.config.login["double-dragon"]){
                             done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
                         }
-                        if(client && typeof client.done === "function"){
-                            client.done();
-                        }
-                        throw err;
-                    }).catch(function(err){
                         console.log('login error',err);
                         console.log(err.stack);
                         done(new Error('internal login error'));
-                    });
+                    } finally {
+                        if(client && typeof client.done === "function"){
+                            client.done();
+                        }
+                    }
                 }
             );
             be.changePassword=async function(client,username,oldPassword,newPassword){
-                var sql = "UPDATE "+(be.config.login.schema?be.db.quoteIdent(be.config.login.schema)+'.':'')+
-                    be.db.quoteIdent(be.config.login.table)+
-                    "\n  SET "+be.db.quoteIdent(be.config.login.passFieldName)+" = $2 "+
-                    "\n  WHERE "+be.db.quoteIdent(be.config.login.userFieldName)+" = $1 "+
-                    (oldPassword!==false?"\n    AND "+be.db.quoteIdent(be.config.login.passFieldName)+" = $3 ":"")+
-                    "\n  RETURNING 1 as ok";
-                var params = [username, md5(newPassword+username.toLowerCase())]
-                if(oldPassword!==false){
-                    params.push(md5(oldPassword+username.toLowerCase()))
+                const { table, passFieldName, userFieldName, schema } = be.config.login;
+                let ok = false;
+                const data = await client.query(
+                    `SELECT *
+                        FROM ${(schema ? be.db.quoteIdent(schema) + '.' : '')}${be.db.quoteIdent(table)}
+                        WHERE ${be.db.quoteIdent(userFieldName)} = $1`, 
+                    [username]
+                ).fetchOneRowIfExists();
+                if (data.rowCount !== 1) {
+                    // Usuario no encontrado
+                    return false;
+                }
+                const user = data.row
+                const storedHash = user[passFieldName];
+                if (oldPassword !== false) {
+                    if (storedHash.startsWith('SCRAM-SHA-256$')) {//Intento SCRAM-SHA-256
+                        ok = await verifyScramPG(oldPassword, storedHash);
+                        if (!ok) {
+                            ok = await verifyScramLegacy(oldPassword, storedHash);
+                        }
+                    } else { //Intento MD5
+                        const md5Hash = md5(oldPassword + username.toLowerCase()); 
+                        ok = (md5Hash === storedHash);
+                    }
+                    if (!ok) {
+                        // La contraseña antigua es incorrecta
+                        return false;
+                    }
+                } else {
+                    // Si no se requiere la contraseña antigua continua
+                    ok = true;
                 }
-                var result = await client.query(sql, params).fetchOneRowIfExists();
-                var ok = result.rowCount == 1;
-                if(ok && be.config.login['double-dragon']){
-                    sql = "ALTER USER " +be.db.quoteIdent(username) + " WITH PASSWORD " + be.db.quoteLiteral(newPassword);
-                    await client.query(sql,[]).execute();
+                // Si la verificación fue exitosa o se omitió (ok == true), generamos el nuevo hash SCRAM
+                if (ok) {
+                    const updateResult = await updatePassword({client, username, password:newPassword, setUpdateDate:true, errorIfNoResult:false});
+                    ok = updateResult.rowCount === 1;
+                    if (ok && be.config.login['double-dragon']) {
+                        const doubleDragonSql = "ALTER USER " + be.db.quoteIdent(username) + " WITH PASSWORD " + be.db.quoteLiteral(newPassword);
+                        await client.query(doubleDragonSql, []).execute();
+                    }
                 }
                 return ok;
-            }
+            };
             be.passwordChanger=function(req, username, oldPassword, newPassword, done) {
                 if(be.config.login.disableChangePassword){
                     done(null,false,'el cambio de contraseña está deshabilitado');
                 }else{
-                    var client;
-                    be.inTransaction(req,function(cli){
-                        client = cli;
+                    be.inTransaction(req,function(client){
                         return be.changePassword(client,username,oldPassword,newPassword)
                     }).then(function(ok){
                         done(null,ok,ok?null:be.messages.server.oldPassDontMatch);
                     }).catch(function(err){
-                        //if(client && client.done){
-                        //    client.done();
-                        //}
                         console.log('error changing pass',err);
                         console.log('stack',err.stack);
                         throw err;
@@ -1236,6 +1498,10 @@ AppBackend.prototype.specialValueWhenInsert = {
     }
 }
 
+AppBackend.prototype.specialSqlDefaultExpressions = {
+    'current_user': 'get_app_user()',
+}
+
 AppBackend.prototype.checkDatabaseStructure = async function checkDatabaseStructure(client){
     var be=this;
     var result = await client.query(`select setting from pg_settings where name='server_version';`).fetchUniqueValue();
@@ -1304,17 +1570,21 @@ AppBackend.prototype.checkDatabaseStructure = async function checkDatabaseStruct
         `;
         throw new Error(message);
     }
-    var {rows: sql_routines} = await client.query(`SELECT routine_name, routine_schema, routine_definition
+    var {rows: sql_routines} = await client.query(`SELECT routine_name, routine_schema, routine_type, routine_definition
         FROM information_schema.routines
         WHERE routine_schema in (${be.config.db.search_path.map(path => be.db.quoteLiteral(path)).join(', ')})
     `).fetchAll();
-    var sqlRoutines = likeAr.toPlainObject(sql_routines, 'routine_name');
+    var sqlRoutines = likeAr.createIndex(sql_routines, 'routine_name');
+    var set_app_user_RoutineType = sqlRoutines.set_app_user?.routine_type || 'inexsistente';
+    if (set_app_user_RoutineType != 'PROCEDURE') {
+        throw new Error('ERROR en la DB: set_app_user no es un PROCEDURE es ' + set_app_user_RoutineType);
+    }
     var message = ''
     likeAr(AppBackend.prototype.sql_routines).forEach((routine_name, def) => {
         if (sqlRoutines[routine_name] && def.dump.includes(sqlRoutines[routine_name].routine_definition)) {
             message += `
                 ----- hay que crear o actualizar la rutina ${routine_name}:
-                ${dump}
+                ${def.dump}
                 `;
         }
     })
@@ -1886,12 +2156,12 @@ AppBackend.prototype.addUnloggedServices = function addUnloggedServices(mainApp,
                         })
                     }
                 })
+                promise.catch(err=>{
+                    console.log('error in /new-password');
+                    console.log(err);
+                })
             }
             res.redirect(Path.posix.join(baseUrl, be.config.login.forget?.urlPathOk+'?result'+resultCode));
-            promise.catch(err=>{
-                console.log('error in /new-password');
-                console.log(err);
-            })
         })
         mainApp.get(Path.posix.join(baseUrl,'/new-pass'), function(req,res,next){
             var resultCode;
@@ -2422,10 +2692,16 @@ AppBackend.prototype.addLoggedServices = function addLoggedServices(){
             throw err;
         }
     });
-    be.app.get('/--version',function(req,res,next){
+    be.app.get('/--version',async function(req,res,next){
+        var simpleGit = require('simple-git');
+        var git = simpleGit(process.cwd());
         var info=[
             html.h1(be.messages.server.versions),
             html.h3([packagejson.name,' ',packagejson.version]),
+            html.ul([
+                html.li([(await git.revparse(['HEAD'])).trim()]),
+                ...((git.tags().all || []).map(tag => html.li([tag]))),
+            ])
         ];
         Promise.resolve().then(function(){
             if(be.isAdmin(req)){
@@ -2653,7 +2929,16 @@ AppBackend.prototype.dumpFkConstraint = function dumpFkConstraint(fk, tableDef,
     return {consName, clause, sourceFieldList};
 }
 
+AppBackend.prototype.isGeneratedSequence = function isGeneratedSequence(sequence, not){
+    return sequence && ((!sequence.name && !sequence.madMax) == !not)
+}
+
+AppBackend.prototype.isSequenceNonGenerated = function isSequenceNonGenerated(sequence){
+    return this.isGeneratedSequence(sequence, true);
+}
+
 AppBackend.prototype.dumpDbTableFields = function dumpDbTableFields(tableDef, opts = {}, complements = null){
+    var be = this;
     var db = this.db;
     var fields=[];
     tableDef.fields.forEach(function(fieldDef){
@@ -2665,9 +2950,13 @@ AppBackend.prototype.dumpDbTableFields = function dumpDbTableFields(tableDef, op
             fields.push(
                 '  '+db.quoteIdent(fieldDef.name)+
                 ' '+(fieldDef.dataLength?(fieldType=='text'?'varchar':fieldType)+'('+fieldDef.dataLength+')':fieldType)+
-                (fieldDef.defaultValue!=null?' default '+db.quoteLiteral(fieldDef.defaultValue):'')+
-                (fieldDef.defaultDbValue!=null?' default '+fieldDef.defaultDbValue:'')+
-                (fieldDef.sequence && !fieldDef.sequence.name?' generated always as identity':'')+
+                ( be.specialSqlDefaultExpressions[fieldDef.defaultDbValue] != null ? ' default ' + be.specialSqlDefaultExpressions[fieldDef.defaultDbValue]
+                : fieldDef.defaultDbValue != null ? ' default ' + fieldDef.defaultDbValue 
+                : be.specialSqlDefaultExpressions[fieldDef.specialDefaultValue] != null ? ' default ' + be.specialSqlDefaultExpressions[fieldDef.specialDefaultValue]
+                : fieldDef.defaultValue != null ? ' default ' + db.quoteLiteral(fieldDef.defaultValue) 
+                : ''
+                ) +
+                (be.isGeneratedSequence(fieldDef.sequence)?' generated always as identity':'')+
                 (fieldDef.generatedAs!=null?` generated always as (${fieldDef.generatedAs}) stored`:'')
             );
             if(complements){
@@ -2774,7 +3063,7 @@ AppBackend.prototype.dumpDbSchemaPartial = async function dumpDbSchemaPartial(pa
                 lines.push('create table '+cualQuoteTableName+' (');
                 var fields = be.dumpDbTableFields(tableDef, opts,
                     function complements(fieldDef){
-                        if(fieldDef.sequence && !fieldDef.sequence.name){
+                        if(be.isGeneratedSequence(fieldDef.sequence)){
                             tablesWithStrictSequence[tableName]={}
                         }
                         if(fieldDef.typeName==='text' && !fieldDef.allowEmptyText){
@@ -2798,7 +3087,7 @@ AppBackend.prototype.dumpDbSchemaPartial = async function dumpDbSchemaPartial(pa
                                 ' alter column '+db.quoteIdent(fieldDef.name)+' set not null;'
                             );
                         }
-                        if(fieldDef.sequence && fieldDef.sequence.name){
+                        if(be.isSequenceNonGenerated(fieldDef.sequence)){
                             fieldsForSequences.push(fieldDef);
                         }
                     }
@@ -2901,19 +3190,26 @@ AppBackend.prototype.dumpDbSchemaPartial = async function dumpDbSchemaPartial(pa
                 });
                 lines.push(tableDef.sql.postCreateSqls);
                 lines.push('');
-                fieldsForSequences.forEach(function(fieldDef) {
+                await Promise.all(fieldsForSequences.map(async function(fieldDef) {
                     var sequence = fieldDef.sequence;
-                    lines.push("CREATE SEQUENCE "+db.quoteIdent(sequence.name)+" START "+db.quoteInteger(sequence.firstValue||1)+";");
-                    lines.push(
-                        "ALTER TABLE "+cualQuoteTableName+
-                        " ALTER COLUMN "+db.quoteIdent(fieldDef.name)+
-                        (sequence.prefix==null
-                        ?" SET DEFAULT nextval("+db.quoteLiteral(sequence.name)+"::regclass);"
-                        :" SET DEFAULT ("+db.quoteLiteral(sequence.prefix)+" || nextval("+db.quoteLiteral(sequence.name)+"::regclass)::text);"
-                        )
-                    );
-                    lines.push('GRANT USAGE, SELECT ON SEQUENCE '+db.quoteIdent(sequence.name)+' TO '+user+';');
-                });
+                    if (sequence.name) {
+                        if (sequence.madMax) throw new Error('a sequence with madMax cannot have name');
+                        lines.push("CREATE SEQUENCE "+db.quoteIdent(sequence.name)+" START "+db.quoteInteger(sequence.firstValue||1)+";");
+                        lines.push(
+                            "ALTER TABLE "+cualQuoteTableName+
+                            " ALTER COLUMN "+db.quoteIdent(fieldDef.name)+
+                            (sequence.prefix==null
+                            ?" SET DEFAULT nextval("+db.quoteLiteral(sequence.name)+"::regclass);"
+                            :" SET DEFAULT ("+db.quoteLiteral(sequence.prefix)+" || nextval("+db.quoteLiteral(sequence.name)+"::regclass)::text);"
+                            )
+                        );
+                        lines.push('GRANT USAGE, SELECT ON SEQUENCE '+db.quoteIdent(sequence.name)+' TO '+user+';');
+                    } else if (sequence.madMax) {
+                        lines.push(await pgTriggers.dumpMaxIdTrigger(tableDef.sql.tableName, fieldDef.name, {grouping: sequence.madMax.grouping, firstValue: sequence.firstValue}));
+                    } else {
+                        throw new Error('a sequence without madMax nor name');
+                    }
+                }));
                 lines.push('');
                 if(tableDef.sql.policies.enabled){
                     policyLines.push(`ALTER TABLE ${cualQuoteTableName} ENABLE ROW LEVEL SECURITY;`);
@@ -2949,8 +3245,8 @@ AppBackend.prototype.dumpDbSchemaPartial = async function dumpDbSchemaPartial(pa
         }
     }
     lines.push(`
-create or replace function set_app_user(p_user text) returns text
-  secirotu definer volatile language plpgsql
+create or replace procedure set_app_user(p_username text)
+  security definer language plpgsql
 as
 $body$
 declare
@@ -2958,7 +3254,7 @@ declare
         ${db.quoteIdent('v_'+fieldName)} text;`
     ).join('')}
 begin
-    if p_user = '!login' then
+    if p_username = '!login' then
         ${be.config.login.infoFieldList.map(fieldName => `
         set backend_plus._${fieldName} = '!';`).join('')}
 
@@ -2966,15 +3262,17 @@ begin
     else
         select ${be.config.login.infoFieldList.map(fieldName => db.quoteIdent(fieldName)).join(', ')}
             into ${be.config.login.infoFieldList.map(fieldName => db.quoteIdent('v_'+fieldName)).join(', ')}
-            from usuarios u left join personas p using (idper)
-                where u."usuario" = p_user;
+            
+            from ${(be.config.login.from ?? (
+                (be.config.login.schema?be.db.quoteIdent(be.config.login.schema)+'.':'')+
+                be.db.quoteIdent(be.config.login.table)))}
+                where ${db.quoteIdent(be.config.login.userFieldName)} = p_username;
         ${be.config.login.infoFieldList.map(fieldName => `
         perform set_config('backend_plus._${fieldName}', v_${fieldName}, false);`).join('')}
 
         set backend_plus._mode = normal;
     end if;
-    perform set_config('backend_plus._user', p_user, false);
-    return p_user;
+    perform set_config('backend_plus._user', p_username, false);
 end;    
 $body$;
 
@@ -3338,8 +3636,10 @@ AppBackend.prototype.exportacionesGenerico = async function exportacionesGeneric
             }
         }
     }
-    await buscarGenerados(csvFileName);
-    await buscarGenerados(fileName);
+    if (!procedureDef.forExport.generarInmediato) {
+        await buscarGenerados(csvFileName);
+        await buscarGenerados(fileName);
+    }
     if(hayGenerados.length>0){
         return hayGenerados;
     }

package/lib/table-def-adapt.js

@@ -137,6 +137,9 @@ function tableDefAdapt(tableDef, context){
         resultTableDef.field[fieldDef.name]=fieldDef;
         if(fieldDef.isName){
             resultTableDef.nameFields.push(fieldDef.name);
+            if (fieldDef.isName == 'known' && resultTableDef.hiddenColumns && !resultTableDef.hiddenColumns.includes(fieldDef.name)) {
+                resultTableDef.hiddenColumns.push(fieldDef.name);
+            }
         }
         return fieldDef;
     });
@@ -174,7 +177,7 @@ function tableDefAdapt(tableDef, context){
     if(resultTableDef.sortColumns){
         resultTableDef.sortColumns.map(function(sortColumn){
             sortColumn.order = sortColumn.order || 1;
-            if (!resultTableDef.field[sortColumn.column]) {
+            if (!resultTableDef.field[sortColumn.column] && !/__/.test(sortColumn.column)) {
                 throw new Error("unkown column " + JSON.stringify(sortColumn.column) + " in sortColumn (or Primarykey) of " + resultTableDef.name);
             }
         });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "backend-plus",
   "description": "Backend for the anti Pareto rule",
-  "version": "2.5.2-betha.4",
+  "version": "2.5.2-betha.41",
   "author": "Codenautas <codenautas@googlegroups.com>",
   "license": "MIT",
   "repository": "codenautas/backend-plus",
@@ -31,43 +31,45 @@
   "dependencies": {
     "@upgraded/locate-path": "^6.0.0-alfa.1",
     "ajax-best-promise": "^0.4.2",
-    "backend-skins": "^0.1.15",
-    "best-globals": "^2.0.1",
+    "backend-skins": "^0.1.17",
+    "best-globals": "^2.0.2",
     "big.js": "^7.0.1",
-    "body-parser": "^2.2.0",
-    "cast-error": "^0.1.1",
+    "body-parser": "^2.2.1",
+    "cast-error": "^0.1.2",
     "castellano": "^0.1.4",
     "connect-pg-simple": "^10.0.0",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
-    "dialog-promise": "^0.10.1",
-    "discrepances": "^0.2.8",
-    "express": "^5.1.0",
-    "express-session": "^1.18.1",
-    "express-useragent": "^1.0.15",
-    "fs-extra": "^11.3.0",
+    "dialog-promise": "^0.10.2",
+    "discrepances": "^0.2.9",
+    "express": "^5.2.1",
+    "express-session": "^1.18.2",
+    "express-useragent": "^2.0.2",
+    "fs-extra": "^11.3.3",
     "js-to-html": "^1.3.2",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.1.1",
     "json4all": "^1.4.0",
     "lazy-some": "^0.1.0",
     "like-ar": "^0.5.1",
-    "login-plus": "^1.7.2",
+    "login-plus": "^1.8.0",
     "memorystore": "^1.6.7",
-    "mini-tools": "^1.13.2",
+    "mini-tools": "^1.13.4",
     "moment": "^2.30.1",
     "multiparty": "^4.2.3",
-    "nodemailer": "^7.0.3",
+    "nodemailer": "^7.0.12",
     "numeral": "^2.0.6",
-    "pg-promise-strict": "^1.4.2",
+    "pg-promise-strict": "^1.4.3",
+    "pg-triggers": "0.4.3",
     "pikaday": "^1.8.2",
     "pug": "^3.0.3",
     "read-yaml-promise": "^1.0.2",
     "regexplicit": "^0.1.3",
-    "require-bro": "^0.3.1",
+    "require-bro": "^0.3.2",
     "self-explain": "^0.11.0",
-    "serve-content": "^0.4.0",
+    "serve-content": "^1.0.2",
     "session-file-store": "^1.5.0",
-    "sql-tools": "^0.1.2",
+    "simple-git": "^3.30.0",
+    "sql-tools": "^0.1.4",
     "stack-trace": "^0.0.10",
     "stylus": "0.64.0",
     "type-store": "^0.4.5",
@@ -77,16 +79,16 @@
   "devDependencies": {
     "@types/big.js": "^6.2.2",
     "@types/expect.js": "~0.3.32",
-    "@types/express": "^5.0.2",
+    "@types/express": "^5.0.6",
     "@types/express-useragent": "^1.0.5",
     "@types/fs-extra": "^11.0.4",
     "@types/js-yaml": "^4.0.9",
     "@types/mocha": "^10.0.10",
     "@types/multiparty": "~4.2.1",
-    "@types/node": "^22.15.29",
-    "@types/nodemailer": "^6.4.17",
+    "@types/node": "^25.0.3",
+    "@types/nodemailer": "^7.0.4",
     "@types/numeral": "~2.0.5",
-    "@types/session-file-store": "^1.2.5",
+    "@types/session-file-store": "^1.2.6",
     "@types/stack-trace": "~0.0.33",
     "@types/websql": "~0.0.30",
     "esprima": "^4.0.1",
@@ -98,13 +100,13 @@
     "karma-ie-launcher": "^1.0.0",
     "karma-mocha": "^2.0.1",
     "kill-9": "~0.4.3",
-    "mocha": "^11.5.0",
+    "mocha": "^11.7.5",
     "nyc": "^17.1.0",
-    "puppeteer": "^24.9.0",
-    "sinon": "^20.0.0",
-    "supertest": "^7.1.1",
+    "puppeteer": "^24.34.0",
+    "sinon": "^21.0.1",
+    "supertest": "^7.1.4",
     "types.d.ts": "~0.6.22",
-    "typescript": "^5.8.3",
+    "typescript": "^5.9.3",
     "why-is-node-running": "^3.2.2"
   },
   "engines": {