cabloy 5.1.189 → 5.1.191

package/vona/src/suite-vendor/a-auth/modules/a-auth/test/oauthRequestContext.test.ts

@@ -3,169 +3,146 @@ import { after, before, describe, it } from 'node:test';
 import { acquireTestLock, app } from 'vona-mock';
 
 describe('oauthRequestContext.test.ts', { concurrency: false }, () => {
-  const releases: Array<() => void> = [];
+  let release: () => void;
 
   before(async () => {
-    releases.push(await acquireTestLock('a-security'));
+    release = await acquireTestLock('a-security');
   });
 
   after(() => {
-    for (const release of releases.reverse()) release();
+    release();
   });
+
   it('passes the callback request through an isolated context without rewriting it', async () => {
     await app.bean.executor.mockCtx(async () => {
-      const proxyPrevious = app.proxy;
-      app.proxy = true;
-      try {
-        const req = {
-          method: 'GET',
-          url: '/api/auth/passport/callback?a=1&b=2',
-          headers: {
-            'host': 'origin.internal.test',
-            'x-forwarded-host': 'demo.example.test',
-            'x-forwarded-proto': 'https',
-            'user-agent': 'oauth-callback-test',
-          },
-          httpVersionMajor: 1,
-          socket: {
-            remoteAddress: '192.0.2.10',
-            remotePort: 443,
-          },
-        };
-        const originalUrl = req.url;
-        const originalHeaders = { ...req.headers };
-        const outerContext = app.ctx;
-        const result = await app.bean.executor.newCtx(
-          async () => {
-            return {
-              context: app.ctx,
-              request: app.ctx.req,
-              method: app.ctx.method,
-              host: app.ctx.host,
-              protocol: app.ctx.protocol,
-              secure: app.ctx.secure,
-              query: app.ctx.request.query,
-              userAgent: app.ctx.get('user-agent'),
-            };
-          },
-          {
-            instanceName: outerContext.instanceName!,
-            req,
-          },
-        );
+      const req = {
+        method: 'GET',
+        url: '/api/auth/passport/callback?a=1&b=2',
+        headers: {
+          'host': 'demo.example.test',
+          'user-agent': 'oauth-callback-test',
+        },
+        httpVersionMajor: 1,
+        socket: {
+          encrypted: true,
+          remoteAddress: '192.0.2.10',
+          remotePort: 443,
+        },
+      };
+      const originalUrl = req.url;
+      const originalHeaders = { ...req.headers };
+      const outerContext = app.ctx;
+      const result = await app.bean.executor.newCtx(
+        async () => {
+          return {
+            context: app.ctx,
+            request: app.ctx.req,
+            method: app.ctx.method,
+            host: app.ctx.host,
+            protocol: app.ctx.protocol,
+            secure: app.ctx.secure,
+            query: app.ctx.request.query,
+            userAgent: app.ctx.get('user-agent'),
+          };
+        },
+        {
+          instanceName: outerContext.instanceName!,
+          req,
+        },
+      );
 
-        assert.notEqual(result.context, outerContext);
-        assert.equal(result.request, req);
-        assert.equal(result.method, 'GET');
-        assert.equal(result.host, 'demo.example.test');
-        assert.equal(result.protocol, 'https');
-        assert.equal(result.secure, true);
-        assert.deepEqual(result.query, { a: '1', b: '2' });
-        assert.equal(result.userAgent, 'oauth-callback-test');
-        assert.equal(req.url, originalUrl);
-        assert.deepEqual(req.headers, originalHeaders);
-        assert.equal(app.ctx, outerContext);
-      } finally {
-        app.proxy = proxyPrevious;
-      }
+      assert.notEqual(result.context, outerContext);
+      assert.equal(result.request, req);
+      assert.equal(result.method, 'GET');
+      assert.equal(result.host, 'demo.example.test');
+      assert.equal(result.protocol, 'https');
+      assert.equal(result.secure, true);
+      assert.deepEqual(result.query, { a: '1', b: '2' });
+      assert.equal(result.userAgent, 'oauth-callback-test');
+      assert.equal(req.url, originalUrl);
+      assert.deepEqual(req.headers, originalHeaders);
+      assert.equal(app.ctx, outerContext);
     });
   });
 
-  it('logs rejected redirects against the canonical server origin', async () => {
-    await app.bean.executor.mockCtx(async () => {
-      const proxyPrevious = app.proxy;
-      const serve = app.ctx.config.server.serve;
-      const servePrevious = { ...serve };
-      app.proxy = true;
-      (serve as any).host = 'canonical.example.test';
-      (serve as any).protocol = 'http';
-      try {
-        const req = {
-          method: 'GET',
-          url: '/api/auth/passport/callback',
-          headers: {
-            'host': 'origin.internal.test',
-            'x-forwarded-host': 'edge.example.test',
-            'x-forwarded-proto': 'https',
-          },
-          httpVersionMajor: 1,
-          socket: {
-            remoteAddress: '192.0.2.10',
-            remotePort: 443,
-          },
-        };
-        await app.bean.executor.newCtx(
-          async () => {
-            assert.equal(app.ctx.host, 'edge.example.test');
-            assert.equal(app.ctx.protocol, 'https');
-            assert.equal(app.util.host, 'canonical.example.test');
-            assert.equal(app.util.protocol, 'http');
+  it('logs rejected redirects against the effective request origin', async () => {
+    const req = {
+      method: 'GET',
+      url: '/api/auth/passport/callback',
+      headers: {
+        host: 'edge.example.test',
+      },
+      httpVersionMajor: 1,
+      socket: {
+        encrypted: true,
+        remoteAddress: '192.0.2.10',
+        remotePort: 443,
+      },
+    };
+    await app.bean.executor.mockCtx(
+      async () => {
+        assert.equal(app.ctx.host, 'edge.example.test');
+        assert.equal(app.ctx.protocol, 'https');
+        assert.equal(app.util.host, 'edge.example.test');
+        assert.equal(app.util.protocol, 'https');
 
-            const service = app.scope('a-auth').service.auth;
-            const logger = (service as any).$logger;
-            const warnPrevious = logger.warn;
-            const warnings: unknown[][] = [];
-            logger.warn = (...args: unknown[]) => warnings.push(args);
-            try {
-              (service as any)._logOauthRedirectRejected(
-                {
-                  id: -1,
-                  providerName: 'auth-oauth:oauth',
-                  clientName: 'github',
-                },
-                {
-                  authProviderId: -1,
-                  instanceName: app.ctx.instanceName!,
-                  locale: app.ctx.locale,
-                  redirect: 'https://edge.example.test/oauth/callback',
-                },
-                'origin_disallowed',
-              );
-            } finally {
-              logger.warn = warnPrevious;
-            }
+        const service = app.scope('a-auth').service.auth;
+        const logger = (service as any).$logger;
+        const warnPrevious = logger.warn;
+        const warnings: unknown[][] = [];
+        logger.warn = (...args: unknown[]) => warnings.push(args);
+        try {
+          (service as any)._logOauthRedirectRejected(
+            {
+              id: -1,
+              providerName: 'auth-oauth:oauth',
+              clientName: 'github',
+            },
+            {
+              authProviderId: -1,
+              instanceName: app.ctx.instanceName!,
+              locale: app.ctx.locale,
+              redirect: 'https://redirect.example.test/oauth/callback',
+            },
+            'origin_disallowed',
+          );
+        } finally {
+          logger.warn = warnPrevious;
+        }
 
-            assert.equal(warnings.length, 1);
-            assert.equal(warnings[0][0], 'OAuth callback final redirect rejected');
-            const diagnostic = warnings[0][1] as Record<string, unknown>;
-            assert.deepEqual(
-              {
-                event: diagnostic.event,
-                stage: diagnostic.stage,
-                outcome: diagnostic.outcome,
-                reason: diagnostic.reason,
-                requestHost: diagnostic.requestHost,
-                requestProtocol: diagnostic.requestProtocol,
-                serveHost: diagnostic.serveHost,
-                serveProtocol: diagnostic.serveProtocol,
-                proxyEnabled: diagnostic.proxyEnabled,
-                redirectHost: diagnostic.redirectHost,
-                hostMatches: diagnostic.hostMatches,
-              },
-              {
-                event: 'auth.oauth_final_redirect_rejected',
-                stage: 'redirect_validation',
-                outcome: 'rejected',
-                reason: 'origin_disallowed',
-                requestHost: 'canonical.example.test',
-                requestProtocol: 'http',
-                serveHost: 'canonical.example.test',
-                serveProtocol: 'http',
-                proxyEnabled: true,
-                redirectHost: 'edge.example.test',
-                hostMatches: false,
-              },
-            );
+        assert.equal(warnings.length, 1);
+        assert.equal(warnings[0][0], 'OAuth callback final redirect rejected');
+        const diagnostic = warnings[0][1] as Record<string, unknown>;
+        assert.deepEqual(
+          {
+            event: diagnostic.event,
+            stage: diagnostic.stage,
+            outcome: diagnostic.outcome,
+            reason: diagnostic.reason,
+            requestHost: diagnostic.requestHost,
+            requestProtocol: diagnostic.requestProtocol,
+            serveHost: diagnostic.serveHost,
+            serveProtocol: diagnostic.serveProtocol,
+            proxyEnabled: diagnostic.proxyEnabled,
+            redirectHost: diagnostic.redirectHost,
+            hostMatches: diagnostic.hostMatches,
           },
           {
-            instanceName: app.ctx.instanceName!,
-            req,
+            event: 'auth.oauth_final_redirect_rejected',
+            stage: 'redirect_validation',
+            outcome: 'rejected',
+            reason: 'origin_disallowed',
+            requestHost: 'edge.example.test',
+            requestProtocol: 'https',
+            serveHost: null,
+            serveProtocol: null,
+            proxyEnabled: false,
+            redirectHost: 'redirect.example.test',
+            hostMatches: false,
           },
         );
-      } finally {
-        app.proxy = proxyPrevious;
-        Object.assign(serve, servePrevious);
-      }
-    });
+      },
+      { req },
+    );
   });
 });

package/vona/src/suite-vendor/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-auth",
-  "version": "5.1.28",
+  "version": "5.1.29",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-pay/modules/a-pay/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-pay",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/modules/a-pay/src/service/paymentCallback.ts

@@ -88,7 +88,7 @@ export class ServicePaymentCallback extends BeanBase {
 
   private _assertTrustedOrigin() {
     const { protocol, host } = this.app.config.server.serve;
-    if (!protocol || !host) {
+    if (!this.app.meta.isTest && (!protocol || !host)) {
       this.app.throw(503, 'payment callbacks require configured server serve protocol and host');
     }
   }

package/vona/src/suite-vendor/a-pay/modules/pay-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-pay-mock",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/modules/pay-paypal/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-pay-paypal",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/modules/pay-stripe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-pay-stripe",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/package.json

@@ -1,15 +1,15 @@
 {
   "name": "vona-suite-a-pay",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "author": "",
   "files": [],
   "type": "module",
   "dependencies": {
-    "vona-module-a-pay": "^5.0.8",
-    "vona-module-pay-mock": "^5.0.8",
-    "vona-module-pay-paypal": "^5.0.8",
-    "vona-module-pay-stripe": "^5.0.8"
+    "vona-module-a-pay": "^5.0.9",
+    "vona-module-pay-mock": "^5.0.9",
+    "vona-module-pay-paypal": "^5.0.9",
+    "vona-module-pay-stripe": "^5.0.9"
   },
   "title": "a-pay"
 }

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.55",
+  "version": "5.1.56",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-core/src/bean/bean.core.ts

@@ -5,23 +5,7 @@ import type { TypeContextFetch } from '../types/fetch.ts';
 
 @Bean()
 export class BeanCore extends BeanBase {
-  get protocol() {
-    return this.app.util.protocol;
-  }
-
-  get host() {
-    return this.app.util.host;
-  }
-
   get fetch(): TypeContextFetch {
     return this.ctx.state.fetch ?? globalThis.fetch;
   }
-
-  getAbsoluteUrl(path?: string) {
-    return this.app.util.getAbsoluteUrl(path);
-  }
-
-  getAbsoluteUrlByApiPath(path: string) {
-    return this.app.util.getAbsoluteUrlByApiPath(path);
-  }
 }

package/vona/src/suite-vendor/a-vona/modules/a-core/src/bean/meta.runtime.ts

@@ -12,8 +12,8 @@ export interface TypeMetaRuntimeResult {
 export class MetaRuntime extends BeanBase implements IMetaRuntimeExecute {
   async execute(): Promise<TypeMetaRuntimeResult> {
     return {
-      protocol: this.bean.core.protocol,
-      host: this.bean.core.host,
+      protocol: this.app.util.protocol,
+      host: this.app.util.host,
     };
   }
 }

package/vona/src/suite-vendor/a-vona/modules/a-ormdialect/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ormdialect",
-  "version": "5.1.17",
+  "version": "5.1.18",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-ormdialect/src/bean/databaseDialect.betterSqlite3.ts

@@ -98,6 +98,7 @@ export class DatabaseDialectBetterSqlite3 extends ServiceDatabaseDialectBase {
 }
 
 async function sqlite3_afterCreate(conn) {
+  conn.pragma('busy_timeout = 5000');
   const pragma: { journal_mode: string }[] = conn.pragma('journal_mode');
   if (pragma[0]?.journal_mode?.toLocaleLowerCase() !== 'wal') {
     conn.pragma('journal_mode = wal');

package/vona/src/suite-vendor/a-vona/modules/a-security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-security",
-  "version": "5.1.14",
+  "version": "5.1.15",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-security/test/origin.test.ts

@@ -1,8 +1,18 @@
 import assert from 'node:assert';
-import { describe, it } from 'node:test';
-import { app } from 'vona-mock';
+import { after, before, describe, it } from 'node:test';
+import { acquireTestLock, app } from 'vona-mock';
 
 describe('origin.test.ts', { concurrency: false }, () => {
+  let release: () => void;
+
+  before(async () => {
+    release = await acquireTestLock('a-security');
+  });
+
+  after(() => {
+    release();
+  });
+
   it('keeps normal CORS separate from exact credential-link authorization', async () => {
     await withWhiteList('*', async () => {
       assert.equal(

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.91",
+  "version": "5.1.92",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/zova/packages-zova/zova/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova",
-  "version": "5.1.166",
+  "version": "5.1.167",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A vue3 framework with ioc",
   "keywords": [
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "zova-core": "^5.1.92",
-    "zova-suite-a-zova": "^5.1.165"
+    "zova-suite-a-zova": "^5.1.166"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",

package/zova/src/suite/a-home/modules/home-passport/src/model/passport.ts

@@ -10,12 +10,7 @@ import type {
 import { combineQueries, isNil } from '@cabloy/utils';
 import { SchemaObject } from 'openapi3-ts/oas31';
 import { $QueryEnsureFresh, $QueryGetFresh, BeanModelBase, Model } from 'zova-module-a-model';
-import {
-  IPermissionHintGeneral,
-  IResourceFormActionRowNameRecord,
-  IResourceTableActionNameRecord,
-  TypeOpenapiPermissions,
-} from 'zova-module-a-openapi';
+import { IPermissionHintGeneral, TypeOpenapiPermissions } from 'zova-module-a-openapi';
 import { ApiApiHomeUserPassportloginOauthPath, OpenApiBaseURL } from 'zova-module-home-api';
 import { isRoleSiteAdmitted } from 'zova-module-home-base';
 
@@ -272,7 +267,7 @@ export class ModelPassport extends BeanModelBase {
 
   public checkPermission(
     permissions: TypeOpenapiPermissions | undefined,
-    actionName?: keyof (IResourceTableActionNameRecord & IResourceFormActionRowNameRecord),
+    actionName?: string,
     permissionHint?: IPermissionHintGeneral,
     currentData?: Record<string, unknown> | readonly Record<string, unknown>[],
   ): boolean {

package/zova/src/suite/cabloy-basic/modules/basic-details/src/bean/tableCell.actionOperationsRow.tsx

@@ -14,7 +14,8 @@ import { VNode } from 'vue';
 import { BeanBase } from 'zova';
 import { TableCell } from 'zova-module-a-table';
 
-import { checkPermission } from '../lib/utils.js';
+import { filterDetailsRowActions } from '../lib/detailsPermissions.js';
+import { checkFormScene } from '../lib/utils.js';
 
 declare module 'zova-module-a-openapi' {
   export interface IResourceDetailsActionRowRecord {
@@ -37,16 +38,16 @@ export class TableCellActionOperationsRow extends BeanBase implements ITableCell
     const { $celScope, $$table } = renderContext;
     const actions = options.actions;
     if (!actions || actions.length === 0) return false;
-    // renders
+    const $$details = $celScope.$$details!;
+    const actionsVisible = actions.filter(action => {
+      return checkFormScene($$details.formScene, action.options?.permission);
+    });
     const renders: TypeTableCellRenderComponent[] = [];
-    for (const action of actions) {
+    for (const action of actionsVisible) {
       const actionName = action.name;
       const actionRender = action.render;
-      const permissionHint = action.options?.permission;
-      if (checkPermission($celScope.formMeta!.formScene!, permissionHint)) {
-        if (!actionRender) throw new Error(`should specify action render: ${actionName}`);
-        renders.push(actionRender);
-      }
+      if (!actionRender) throw new Error(`should specify action render: ${actionName}`);
+      renders.push(actionRender);
     }
     await $$table.cellRenderPrepare(renders);
     return renders.length > 0;
@@ -60,13 +61,18 @@ export class TableCellActionOperationsRow extends BeanBase implements ITableCell
     const { $celScope, $$table } = renderContext;
     const actions = options.actions;
     if (!actions || actions.length === 0) return;
+    const $$details = $celScope.$$details!;
+    const actionsAllowed = filterDetailsRowActions(
+      $$details.formScene,
+      $$details.checkPermission.bind($$details),
+      actions,
+    );
     const domActions: VNode[] = [];
-    actions.forEach((action, index) => {
-      const permissionHint = action.options?.permission;
-      if (!checkPermission($celScope.formMeta!.formScene!, permissionHint)) return;
-      const options2 = Object.assign({ key: index }, action.options);
-      domActions.push($$table.cellRender(action.render!, options2, renderContext));
+    actionsAllowed.forEach((action, index) => {
+      const actionOptions = Object.assign({ key: index }, action.options);
+      domActions.push($$table.cellRender(action.render!, actionOptions, renderContext));
     });
+    if (domActions.length === 0) return;
     return <div class={options.class}>{domActions}</div>;
   }
 }

package/zova/src/suite/cabloy-basic/modules/basic-details/src/component/blockDetails/controller.tsx

@@ -13,6 +13,8 @@ import {
 } from 'zova-module-a-openapi';
 import { BeanControllerTableBase } from 'zova-module-a-table';
 
+import type { TypeDetailsCheckPermission } from '../../types/details.js';
+
 declare module 'zova-module-a-openapi' {
   export interface IResourceBlockRecord {
     'basic-details:blockDetails'?: ControllerBlockDetailsProps;
@@ -26,6 +28,7 @@ export interface ControllerBlockDetailsProps<
   formMeta?: IFormMeta;
   schemaRow?: ISchemaObjectExtensionField;
   schemaForm?: ISchemaObjectExtensionField;
+  checkPermission?: TypeDetailsCheckPermission;
   getDetailItems?: () => TData[] | undefined;
   setDetailItems?: (detailItems: TData[]) => void;
 }
@@ -70,6 +73,14 @@ export class ControllerBlockDetails<TData extends {} = {}> extends BeanControlle
     return this.$props.schemaForm!;
   }
 
+  checkPermission(...args: Parameters<TypeDetailsCheckPermission>) {
+    const checkPermission = this.$props.checkPermission;
+    if (!checkPermission) {
+      throw new Error('should provide enclosing Resource permission checker for details');
+    }
+    return checkPermission(...args);
+  }
+
   public async setTableRef(tableRef: BeanControllerTableBase<TData> | undefined) {
     this.tableRef = tableRef;
   }

package/zova/src/suite/cabloy-basic/modules/basic-details/src/component/blockToolbarBulk/controller.tsx

@@ -9,7 +9,7 @@ import { VNode } from 'vue';
 import { BeanControllerBase, Use } from 'zova';
 import { Controller } from 'zova-module-a-bean';
 
-import { checkPermission } from '../../lib/utils.js';
+import { filterDetailsBulkActions } from '../../lib/detailsPermissions.js';
 
 declare module 'zova-module-a-openapi' {
   export interface IResourceBlockRecord {
@@ -46,9 +46,12 @@ export class ControllerBlockToolbarBulk extends BeanControllerBase {
     const actions = this.$props.actions;
     if (!actions || actions.length === 0) return;
     const domActions: VNode[] = [];
-    actions.forEach((action, index) => {
-      const permissionHint = action.options?.permission;
-      if (!checkPermission($$details.formScene, permissionHint)) return;
+    const allowedActions = filterDetailsBulkActions(
+      $$details.formScene,
+      $$details.checkPermission.bind($$details),
+      actions,
+    );
+    allowedActions.forEach((action, index) => {
       const options = Object.assign({ key: index }, action.options);
       const domAction = $jsx.render(action.render!, options, $celScope, this.$$renderContext);
       if (!domAction) return;