data-primals-engine 1.0.11 → 1.1.0

package/src/middlewares/middleware-mongodb.js

@@ -1,110 +1,108 @@
-import {isIsoDate} from "../core.js";
-
 const TEST_REGEX = /^\$|\./;
 const TEST_REGEX_WITHOUT_DOT = /^\$/;
 const REPLACE_REGEX = /^\$|\./g;
 
 function isPlainObject(obj) {
-  return typeof obj === 'object' && obj !== null;
+    return typeof obj === 'object' && obj !== null;
 }
 
 function getTestRegex(allowDots) {
-  return allowDots ? TEST_REGEX_WITHOUT_DOT : TEST_REGEX;
+    return allowDots ? TEST_REGEX_WITHOUT_DOT : TEST_REGEX;
 }
 
 function withEach(target, cb) {
-  (function act(obj) {
-    if (Array.isArray(obj)) {
-      obj.forEach(act);
-    } else if (isPlainObject(obj)) {
-      Object.keys(obj).forEach(function (key) {
-        const val = obj[key];
-        const resp = cb(obj, val, key);
-        if (resp.shouldRecurse) {
-          act(obj[resp.key || key]);
+    (function act(obj) {
+        if (Array.isArray(obj)) {
+            obj.forEach(act);
+        } else if (isPlainObject(obj)) {
+            Object.keys(obj).forEach(function (key) {
+                const val = obj[key];
+                const resp = cb(obj, val, key);
+                if (resp.shouldRecurse) {
+                    act(obj[resp.key || key]);
+                }
+            });
         }
-      });
-    }
-  })(target);
+    })(target);
 }
 
 function has(target, allowDots) {
-  const regex = getTestRegex(allowDots);
-
-  let hasProhibited = false;
-  withEach(target, function (obj, val, key) {
-    if (regex.test(key)) {
-      hasProhibited = true;
-      return { shouldRecurse: false };
-    } else {
-      return { shouldRecurse: true };
-    }
-  });
+    const regex = getTestRegex(allowDots);
+
+    let hasProhibited = false;
+    withEach(target, function (obj, val, key) {
+        if (regex.test(key)) {
+            hasProhibited = true;
+            return { shouldRecurse: false };
+        } else {
+            return { shouldRecurse: true };
+        }
+    });
 
-  return hasProhibited;
+    return hasProhibited;
 }
 
 function _sanitize(target, options) {
-  const regex = getTestRegex(options.allowDots);
+    const regex = getTestRegex(options.allowDots);
 
-  let isSanitized = false;
-  let replaceWith = null;
-  const dryRun = Boolean(options.dryRun);
-  if (!regex.test(options.replaceWith) && options.replaceWith !== '.') {
-    replaceWith = options.replaceWith;
-  }
+    let isSanitized = false;
+    let replaceWith = null;
+    const dryRun = Boolean(options.dryRun);
+    if (!regex.test(options.replaceWith) && options.replaceWith !== '.') {
+        replaceWith = options.replaceWith;
+    }
 
-  const wl = options.whitelist || [];
-  RegExp.prototype.toJSON = RegExp.prototype.toString;
+    const wl = options.whitelist || [];
+    RegExp.prototype.toJSON = RegExp.prototype.toString;
 
-  withEach(target, function (obj, val, key) {
-    let shouldRecurse = true;
+    withEach(target, function (obj, val, key) {
+        let shouldRecurse = true;
+
+        if( (key === 'regex' && obj.input) || key === '$regex' ){
+            obj[key] = new RegExp(val, "ui");
+            console.log('regex san', obj[key]);
+        }
+        else if (!wl.includes(key) && regex.test(key)) {
+            isSanitized = true;
+            // if dryRun is enabled, do not modify the target
+            if (dryRun) {
+                return {
+                    shouldRecurse: shouldRecurse,
+                    key: key
+                };
+            }
+            delete obj[key];
+            if (replaceWith) {
+                key = key.replace(REPLACE_REGEX, replaceWith);
+                // Avoid to set __proto__ and constructor.prototype
+                // https://portswigger.net/daily-swig/prototype-pollution-the-dangerous-and-underrated-vulnerability-impacting-javascript-applications
+                // https://snyk.io/vuln/SNYK-JS-LODASH-73638
+                if (
+                    key !== '__proto__' &&
+                    key !== 'constructor' &&
+                    key !== 'prototype'
+                ) {
+                    obj[key] = val;
+                }
+            } else {
+                shouldRecurse = false;
+            }
+        }
 
-    if( (key === 'regex' && obj.input) || key === '$regex' ){
-      obj[key] = new RegExp(val, "ui");
-      console.log('regex san', obj[key]);
-    }
-    else if (!wl.includes(key) && regex.test(key)) {
-      isSanitized = true;
-      // if dryRun is enabled, do not modify the target
-      if (dryRun) {
         return {
-          shouldRecurse: shouldRecurse,
-          key: key,
+            shouldRecurse: shouldRecurse,
+            key: key
         };
-      }
-      delete obj[key];
-      if (replaceWith) {
-        key = key.replace(REPLACE_REGEX, replaceWith);
-        // Avoid to set __proto__ and constructor.prototype
-        // https://portswigger.net/daily-swig/prototype-pollution-the-dangerous-and-underrated-vulnerability-impacting-javascript-applications
-        // https://snyk.io/vuln/SNYK-JS-LODASH-73638
-        if (
-          key !== '__proto__' &&
-          key !== 'constructor' &&
-          key !== 'prototype'
-        ) {
-          obj[key] = val;
-        }
-      } else {
-        shouldRecurse = false;
-      }
-    }
+    });
 
     return {
-      shouldRecurse: shouldRecurse,
-      key: key,
+        isSanitized,
+        target
     };
-  });
-
-  return {
-    isSanitized,
-    target,
-  };
 }
 
 function sanitize(target, options = {}) {
-  return _sanitize(target, options).target;
+    return _sanitize(target, options).target;
 }
 
 /**
@@ -112,20 +110,23 @@ function sanitize(target, options = {}) {
  * @returns {function}
  */
 export function middleware(options = {}) {
-  const hasOnSanitize = typeof options.onSanitize === 'function';
-  return function (req, res, next) {
-    ['body', 'params', 'headers', 'query'].forEach(function (key) {
-      if (req[key]) {
-        const { target, isSanitized } = _sanitize(req[key], options);
-        req[key] = target;
-        if (isSanitized && hasOnSanitize) {
-          options.onSanitize({
-            req,
-            key,
-          });
-        }
-      }
-    });
-    next();
-  };
-}
+    const hasOnSanitize = typeof options.onSanitize === 'function';
+    return function (req, res, next) {
+        ['body', 'params', 'headers', 'query'].forEach(function (key) {
+            if (req[key]) {
+                // The _sanitize function mutates the req[key] object in-place.
+                // We only need to capture whether it was sanitized to call the hook.
+                const { isSanitized } = _sanitize(req[key], options);
+
+                // The problematic assignment `req[key] = target;` is removed.
+                if (isSanitized && hasOnSanitize) {
+                    options.onSanitize({
+                        req,
+                        key
+                    });
+                }
+            }
+        });
+        next();
+    };
+}

package/src/migrate.js

@@ -30,30 +30,30 @@ engine.start(port, async () => {
         const { executedNames, allMigrationFiles } = await getMigrationStatus(db);
 
         switch (command) {
-            case 'create':
-                if (!target) throw new Error("Please provide a name for the migration.");
-                await createMigrationFile(target, logger);
-                break;
-            case 'status':
-                displayStatus(executedNames, allMigrationFiles, logger);
-                break;
-            case 'up':
-                await runMigrations('up', null, logger, db, executedNames, allMigrationFiles);
-                break;
-            case 'down':
-                // Annule la dernière migration
-                await runMigrations('down', 'last', logger, db, executedNames, allMigrationFiles);
-                break;
-            case 'to':
-                if (!target) throw new Error("Please specify a target migration file for the 'to' command.");
-                await runMigrations('up', target, logger, db, executedNames, allMigrationFiles);
-                break;
-            case 'revert':
-                if (!target) throw new Error("Please specify a target migration file for the 'revert' command. Use '0' to revert all.");
-                await runMigrations('down', target, logger, db, executedNames, allMigrationFiles);
-                break;
-            default:
-                throw new Error(`Unknown command: ${command}. Use 'up', 'down', 'create', 'status', 'to', 'revert'.`);
+        case 'create':
+            if (!target) throw new Error("Please provide a name for the migration.");
+            await createMigrationFile(target, logger);
+            break;
+        case 'status':
+            displayStatus(executedNames, allMigrationFiles, logger);
+            break;
+        case 'up':
+            await runMigrations('up', null, logger, db, executedNames, allMigrationFiles);
+            break;
+        case 'down':
+            // Annule la dernière migration
+            await runMigrations('down', 'last', logger, db, executedNames, allMigrationFiles);
+            break;
+        case 'to':
+            if (!target) throw new Error("Please specify a target migration file for the 'to' command.");
+            await runMigrations('up', target, logger, db, executedNames, allMigrationFiles);
+            break;
+        case 'revert':
+            if (!target) throw new Error("Please specify a target migration file for the 'revert' command. Use '0' to revert all.");
+            await runMigrations('down', target, logger, db, executedNames, allMigrationFiles);
+            break;
+        default:
+            throw new Error(`Unknown command: ${command}. Use 'up', 'down', 'create', 'status', 'to', 'revert'.`);
         }
     } catch (error) {
         logger.error(chalk.red("Migration process failed:"), error.message);

package/src/modules/assistant.js

@@ -25,13 +25,13 @@ export const assistantGlobalLimiter = rateLimit({
 });
 
 const createSystemPrompt = (modelDefs) => {
-const cond1 = JSON.stringify({ "model": "event", "sort": "startDate:ASC", "limit": 0, "filter": { "$and": [{ "$nin": ["$tags", "festival"] }, { "$lt": ["$endDate", "$$NOW"] }] }}, null, 2);
+    const cond1 = JSON.stringify({ "model": "event", "sort": "startDate:ASC", "limit": 0, "filter": { "$and": [{ "$nin": ["$tags", "festival"] }, { "$lt": ["$endDate", "$$NOW"] }] }}, null, 2);
     const cond2 = JSON.stringify({ "model": "contact", "sort": "legalName:ASC", "limit": 5,"filter": {"$ne": [{ "$type": "$legalName"}, "missing"] }}, null, 2);
     const cond3 = JSON.stringify({ "model": "order", "sort": "_id:DESC", "limit": 10,"filter": {"lang": { "$find": [{ "$eq": ["$$this.code", "fr"] }] } }}, null, 2);
     const cond4 = JSON.stringify({ "model": "order", "sort": "updatedAt:DESC", "limit": 0,"filter": {"user": { "$find": { "roles": { "$find": [{ "$in": ["$$this.name", ["admin", "moderator"]] }] } }}}}, null, 2);
 
     return `
-Tu es "Prior", un assistant expert en analyse de données pour la plateforme data.primals.net.
+Tu es "Prior", un assistant expert en analyse de données pour le moteur data-primals-engine..
 Ta mission est d'aider l'utilisateur en répondant à ses questions sur ses données.
 
 STRICTEMENT INTERDIT :
@@ -161,7 +161,7 @@ async function handleChatRequest(message, history, provider, context, user, conf
     const envKeyName = providers[p];
     if (!envKeyName) return { success: false, message: `Fournisseur IA non supporté : ${p}` };
 
-    const envCollection = getCollectionForUser(user);
+    const envCollection = await getCollectionForUser(user);
     const userEnvVar = await envCollection.findOne({ _model: 'env', name: envKeyName, _user: user.username });
     apiKey = userEnvVar?.value || process.env[envKeyName];
 
@@ -214,54 +214,54 @@ async function handleChatRequest(message, history, provider, context, user, conf
             };
         }
 
-// Exécution IMMÉDIATE des actions sans confirmation (sauf pour post/update/delete)
+        // Exécution IMMÉDIATE des actions sans confirmation (sauf pour post/update/delete)
         switch (parsedResponse.action) {
-            case 'search': {
-                const searchResult = await searchData({
-                    user,
-                    query: {
-                        model: parsedResponse.params.model,
-                        filter: parsedResponse.params.filter,
-                        limit: parsedResponse.params.limit || 10
-                    }
-                });
-
-                const resultString = searchResult.data.length > 0
-                    ? i18n.t('assistant.searchResults', "Voici les résultats :") +
+        case 'search': {
+            const searchResult = await searchData({
+                user,
+                query: {
+                    model: parsedResponse.params.model,
+                    filter: parsedResponse.params.filter,
+                    limit: parsedResponse.params.limit || 10
+                }
+            });
+                
+            const resultString = searchResult.data.length > 0
+                ? i18n.t('assistant.searchResults', "Voici les résultats :") +
                     searchResult.data.map(item =>
                         `\n- ${getDataAsString(allModels.find(m => m.name === parsedResponse.params.model), item, i18n.t, allModels, true)}`
                     ).join('')
-                    : i18n.t('assistant.noResults', "Aucun résultat trouvé.");
+                : i18n.t('assistant.noResults', "Aucun résultat trouvé.");
 
-                return { success: true, displayMessage: resultString };
-            }
-            case 'displayMessage':
-                return { success: true, displayMessage: parsedResponse.params.message };
-            case 'code':
-                return { success: true, displayMessage: "Voici le code : " + parsedResponse.params.code };
-            case 'post':
-            case 'update':
-            case 'delete': {
-                const { model, filter, data } = parsedResponse.params;
-
-                // Un message générique. Les détails seront affichés par le front-end.
-                const confirmationMessage = i18n.t('assistant.confirmActionPrompt', "Veuillez confirmer l'action suivante :");
-
-                return {
-                    success: true,
-                    model,
-                    filter,
-                    data,
-                    displayMessage: confirmationMessage, // Message détaillé pour l'utilisateur
-                    confirmationRequest: parsedResponse // Action complète pour l'exécution
-                };
-            }
+            return { success: true, displayMessage: resultString };
+        }
+        case 'displayMessage':
+            return { success: true, displayMessage: parsedResponse.params.message };
+        case 'code':
+            return { success: true, displayMessage: "Voici le code : " + parsedResponse.params.code };
+        case 'post':
+        case 'update':
+        case 'delete': {
+            const { model, filter, data } = parsedResponse.params;
+
+            // Un message générique. Les détails seront affichés par le front-end.
+            const confirmationMessage = i18n.t('assistant.confirmActionPrompt', "Veuillez confirmer l'action suivante :");
+
+            return {
+                success: true,
+                model,
+                filter,
+                data,
+                displayMessage: confirmationMessage, // Message détaillé pour l'utilisateur
+                confirmationRequest: parsedResponse // Action complète pour l'exécution
+            };
+        }
 
-            default:
-                return {
-                    success: true,
-                    displayMessage: i18n.t('assistant.unknownAction', "Commande non reconnue.")
-                };
+        default:
+            return {
+                success: true,
+                displayMessage: i18n.t('assistant.unknownAction', "Commande non reconnue.")
+            };
         }
     }
 
@@ -278,16 +278,16 @@ async function handleChatRequest(message, history, provider, context, user, conf
 async function executeConfirmedAction(action, params, user) {
     logger.info(`[Assistant] Exécution de l'action confirmée par l'utilisateur: ${action}`);
     switch (action) {
-        case 'post':
-            // Note : on passe false pour ne pas redéclencher de workflow ici
-            return await insertData(params.model, params.data, {}, user, false, false);
-        case 'update':
-            return await patchData(params.model, params.filter, params.data, {}, user);
-        case 'delete':
-            // Le modèle est dans les params, pas besoin de le passer en argument sparé
-            return await deleteData(params.model, [], params.filter, user);
-        default:
-            throw new Error(`Action confirmée non supportée: ${action}`);
+    case 'post':
+        // Note : on passe false pour ne pas redéclencher de workflow ici
+        return await insertData(params.model, params.data, {}, user, false, false);
+    case 'update':
+        return await patchData(params.model, params.filter, params.data, {}, user);
+    case 'delete':
+        // Le modèle est dans les params, pas besoin de le passer en argument sparé
+        return await deleteData(params.model, [], params.filter, user);
+    default:
+        throw new Error(`Action confirmée non supportée: ${action}`);
     }
 }
 

package/src/modules/bucket.js

@@ -6,7 +6,7 @@ import {decryptValue, encryptValue} from "../data.js";
 import {MongoClient} from "../engine.js";
 import {loadFromDump, validateRestoreRequest} from "./data.js";
 import {Logger} from "../gameObject.js";
-import {middlewareAuthenticator, myFreePremiumAnonymousLimiter, userInitiator} from "./user.js";
+import {middlewareAuthenticator, userInitiator} from "./user.js";
 import {awsDefaultConfig, maxBytesPerSecondThrottleData} from "../constants.js";
 import crypto from "node:crypto";
 import i18n from "data-primals-engine/i18n";
@@ -24,7 +24,7 @@ export const requestRestore = async (user, lang) => {
     restoreRequests[user?.username] = {
         fullToken: fullRestoreToken,
         modelsToken: modelsRestoreToken,
-        expiresAt: expiration,
+        expiresAt: expiration
     };
 
     i18n.changeLanguage(lang);
@@ -51,7 +51,7 @@ const getDefaultS3Config = () => {
         accessKeyId: process.env.AWS_ACCESS_KEY_ID,
         secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY, // Utiliser la clé déchiffrée
         region: process.env.AWS_REGION || awsDefaultConfig.region,
-        bucketName: process.env.AWS_BUCKET || awsDefaultConfig.bucketName,
+        bucketName: process.env.AWS_BUCKET || awsDefaultConfig.bucketName
     };
 }
 const getS3Client = (s3Config) => {
@@ -77,7 +77,7 @@ export const uploadToS3 = async (s3Config, filePath, remoteFilename) => {
     const params = {
         Bucket: s3Config.bucketName,
         Key: bucketPath,
-        Body: fileContent,
+        Body: fileContent
     };
 
     try {
@@ -96,7 +96,7 @@ export const listS3Backups = async (s3Config) => {
 
     const params = {
         Bucket: s3Config.bucketName,
-        Prefix: bucketPathPrefix,
+        Prefix: bucketPathPrefix
     };
 
     try {
@@ -119,7 +119,7 @@ export const downloadFromS3 = async (s3Config, s3FileKey, downloadPath) => {
     const s3 = getS3Client(s3Config);
     const params = {
         Bucket: s3Config.bucketName,
-        Key: s3FileKey,
+        Key: s3FileKey
     };
 
     try {
@@ -140,7 +140,8 @@ export async function onInit(defaultEngine) {
     engine = defaultEngine;
     logger = engine.getComponent(Logger);
 
-    engine.post('/api/backup/request-restore', [throttle, middlewareAuthenticator, userInitiator, myFreePremiumAnonymousLimiter], async (req, res) => {
+    const userMiddlewares = await engine.userProvider.getMiddlewares();
+    engine.post('/api/backup/request-restore', [throttle, middlewareAuthenticator, userInitiator, ...userMiddlewares], async (req, res) => {
         const user = req.me; // Assuming you have user authentication middleware
         if (!user) {
             return res.status(401).json({ error: 'Unauthorized' });
@@ -177,7 +178,7 @@ export async function onInit(defaultEngine) {
         }
     });
 
-    engine.post('/api/user/s3-config', [middlewareAuthenticator, userInitiator, myFreePremiumAnonymousLimiter], async (req, res) => {
+    engine.post('/api/user/s3-config', [middlewareAuthenticator, userInitiator, ...userMiddlewares], async (req, res) => {
         const user = req.me;
         const { bucketName, accessKeyId, secretAccessKey, region, pathPrefix } = req.fields;
 
@@ -192,7 +193,7 @@ export async function onInit(defaultEngine) {
                 's3Config.bucketName': bucketName,
                 's3Config.accessKeyId': accessKeyId, // Stocké en clair (généralement acceptable)
                 's3Config.region': region,
-                's3Config.pathPrefix': pathPrefix || '', // S'assurer qu'il y a une valeur par défaut si vide
+                's3Config.pathPrefix': pathPrefix || '' // S'assurer qu'il y a une valeur par défaut si vide
             };
 
             // Chiffrer et mettre à jour la clé secrète uniquement si elle est fournie