data-primals-engine 1.1.5 → 1.1.7-rc1

package/.github/workflows/node.js.yml

@@ -11,7 +11,9 @@ on:
 
 jobs:
   build:
-
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     container:
       image: node:20  # Specify the Docker version you needx

package/README.md

@@ -58,6 +58,10 @@ MONGO_DB_URL=mongodb://127.0.0.1:27017
 | SMTP_PORT             | 	SMTP server port.	                                                     | 587                                      |
 | SMTP_USER             | 	Username for SMTP authentication.                                      | 	user@example.com                        |
 | SMTP_PASS             | 	Password for SMTP authentication.                                      | 	password                                |
+| TLS                   | 	Encrypted connection (TLS) mode. Disabled by default                   | 	0/1 false/true                          |
+| CERT                  | 	Path to cert file.                                                     | 	certs/ca.crt                            |
+| CA_CERT               | 	Path to CA cert file.                                                  | 	certs/cert.pem                          |
+| CERT_KEY              | Path to the key file for your certificate.                              | 	certs/key.pem                           |
 
 Start the server:
 ```bash

package/client/src/App.jsx

@@ -53,7 +53,7 @@ import {Helmet} from "react-helmet";
 import {useCookies, CookiesProvider} from "react-cookie";
 
 import { translations as allTranslations} from "../../src/i18n.js";
-import {getRandom} from "../../src/core.js";
+import {getBrowserRandom, getRandom} from "../../src/core.js";
 import {getUserHash} from "../../src/data.js";
 import {seoTitle} from "./constants.js";
 import {host, useAI} from "../../src/constants.js";
@@ -254,7 +254,7 @@ function Layout ({header, translationMutation, routes, body, footer}) {
     const menu=<>{(!me) && !loc.pathname.startsWith("/user/demo") && (<Button className={"btn btn-nav btn-ellipsis btn-primary btn-big"} onClick={() => {
         gtag("event", "nav to demo");
         setCurrentProfile(null);
-        const username = 'demo'+getRandom(1, 99);
+        const username = 'demo'+getBrowserRandom(1, 99);
         setMe({username});
         setCookie('username', username, { path : "/", domain: isProd ? host : 'localhost'});
         nav('/user/'+username, { state: { startTour: true } });
@@ -276,7 +276,7 @@ function Layout ({header, translationMutation, routes, body, footer}) {
 
     useEffect(() => {
         if( !cookies.username) {
-            const username ='demo' + getRandom(1, 99);
+            const username ='demo' + getBrowserRandom(1, 99);
             setCookie("username", username, { path : "/", domain: isProd ? host : 'localhost'});
             onAuthenticated({username}, true);
         }
@@ -360,7 +360,7 @@ function Layout ({header, translationMutation, routes, body, footer}) {
     const handleGenerateClick = (p) => {
         gtag('event', 'homepage model generation');
         setCurrentTour(null);
-        const username = 'demo'+getRandom(0, 99);
+        const username = 'demo'+getBrowserRandom(0, 99);
         setMe({username});
 
         setPromptResult(null);

package/client/src/DataEditor.jsx

@@ -8,7 +8,7 @@ import RelationField from "./RelationField.jsx";
 import {
     CheckboxField,
     CodeField,
-    ColorField,
+    ColorField, EmailField,
     EnumField,
     FileField, ModelField, NumberField,
     PhoneField,
@@ -470,6 +470,8 @@ export const DataEditor = forwardRef(function MyDataEditor({
                 return <FileField help={t('field_'+model.name+'_'+field.name+'_hint', field.hint || '')} key={field.name} name={field.name} maxSize={field.maxSize} mimeTypes={field.mimeTypes} value={value} onChange={(file) => handleChange({ name: name, value: file ? file.name : null })} />
             case 'color':
                 return <ColorField help={t('field_'+model.name+'_'+field.name+'_hint', field.hint || '')} key={field.name} name={field.name} value={value} onChange={handleChange} />
+            case 'email':
+                return <EmailField onFocus={() => setFocusedField(field)} onBlur={() => setFocusedField(null)} help={focusedField?.name === field.name ? t('field_'+model.name+'_'+field.name+'_hint', field.hint || '') : ''} key={field.name} type={getInputType(field.type)} {...inputProps} onChange={(e) => handleChange({name: field.name, value: e.target.value})} />
             default:
                 return <TextField onFocus={() => setFocusedField(field)} onBlur={() => setFocusedField(null)} help={focusedField?.name === field.name ? t('field_'+model.name+'_'+field.name+'_hint', field.hint || '') : ''} key={field.name} type={getInputType(field.type)} {...inputProps} onChange={(e) => handleChange({name: field.name, value: e.target.value})} />
         }

package/client/src/Field.jsx

@@ -35,6 +35,7 @@ import { PhoneInput } from 'react-international-phone';
 import 'react-international-phone/style.css';
 import CodeMirror, {basicSetup} from "@uiw/react-codemirror";
 import {useAuthContext} from "./contexts/AuthContext.jsx";
+import {maxStringLength} from "data-primals-engine/constants";
 
 export const Form = ({
   name,
@@ -259,10 +260,8 @@ const EmailField = forwardRef(
       if (maxlength !== undefined && maxlength > 0 && value && value.trim().length > maxlength) {
         errs.push("Value length must be <= to " + maxlength);
       }
-      if (
-        value &&
-        !value.match(/^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/)
-      ) {
+
+    if (value && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) {
         errs.push("Invalid email");
       }
       setErrors(errs);

package/client/src/FlexBuilder.jsx

@@ -19,6 +19,7 @@ import {
     clearMappingsRecursive
 } from './FlexTreeUtils.js';
 import {Dialog, DialogProvider} from "./Dialog.jsx";
+import {safeAssignObject} from "data-primals-engine/core";
 
 const FlexBuilder = ({ initialConfig = null, models = [], onChange, data = [], lang = 'fr' }) => {
     const { me: user } = useAuthContext();
@@ -104,7 +105,8 @@ const FlexBuilder = ({ initialConfig = null, models = [], onChange, data = [], l
                     current[pathArray[i]] = current[pathArray[i]] || {};
                     current = current[pathArray[i]];
                 }
-                current[pathArray[pathArray.length - 1]] = value;
+                const key = pathArray[pathArray.length - 1];
+                safeAssignObject(current, key, value);
                 return newNode;
             };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "data-primals-engine",
-  "version": "1.1.5",
+  "version": "1.1.7-rc1",
   "description": "data-primals-engine is the package responsible from handling large amount of data in a practical and performant way. It can handle large amount of data in a practical and performant way. It can also get workflow models working (for automation), and fully supports internationalisation.",
   "main": "src/engine.js",
   "type": "module",

package/src/constants.js

@@ -1,3 +1,5 @@
+import {event_trigger} from "./core.js";
+
 /**
  * Enables auto-installation at startup
  * @type {boolean}
@@ -214,7 +216,25 @@ export const maxTotalPrivateFilesSize = 250 * megabytes;
  */
 export const timeoutVM = 5000;
 
-export const defaultMaxRequestData = 50000;
+/**
+ * Default maximum number of data per request
+ * @type {number}
+ */
+export const defaultMaxRequestData = 500;
+
+/**
+ * Database connections pool size for MongoDB access
+ * @type {number}
+ */
+export const databasePoolSize = 30;
+
+/**
+ * TLS options for MongoDB access
+ * @type {boolean}
+ */
+export const tlsAllowInvalidCertificates = false;
+export const tlsAllowInvalidHostnames = false;
+
 /**
  * Options for the HTML sanitizer
  * @type {{allowedSchemesByTag: {}, selfClosing: string[], allowedSchemes: string[], enforceHtmlBoundary: boolean, disallowedTagsMode: string, allowProtocolRelative: boolean, allowedAttributes: {a: string[], img: string[], code: string[]}, allowedTags: string[], allowedSchemesAppliedToAttributes: string[]}}

package/src/core.js

@@ -11,6 +11,11 @@ export function escapeRegex(string) {
 
 export const isDate = dt => String(new Date(dt)) !== 'Invalid Date'
 
+export const safeAssignObject = (obj, key, value) => {
+    if( !["__proto__", "constructor"].includes(key)){
+        obj[key] = value;
+    }
+}
 export function debounce(callback, delay=300){
     var timer;
     return function(){
@@ -176,9 +181,54 @@ function splitmix32(a) {
 
 export const getRand = () =>splitmix32(seed);
 
-export const getRandom = (minInclusive,maxInclusive) => {
-    return Math.floor(Math.random() * (maxInclusive - minInclusive + 1) + minInclusive);
-};
+const MAX_RANGE_SIZE = 2n ** 64n
+const buffer = new BigUint64Array(512)
+let offset = buffer.length
+
+/**
+ * Returns a cryptographically secure random integer between min and max, inclusive.
+ *
+ * @param {number} min - the lowest integer in the desired range (inclusive)
+ * @param {number} max - the highest integer in the desired range (inclusive)
+ * @returns {number} Random number
+ */
+
+export function getRandom(min, max) {
+    if (!(Number.isSafeInteger(min) && Number.isSafeInteger(max))) {
+        throw Error("min and max must be safe integers")
+    }
+    if (min > max) {
+        throw Error("min must be less than or equal to max")
+    }
+    const bmin = BigInt(min)
+    const rangeSize = BigInt(max) - bmin + 1n
+    const rejectionThreshold = MAX_RANGE_SIZE - (MAX_RANGE_SIZE % rangeSize)
+    let result;
+    do {
+        if (offset >= buffer.length) {
+            crypto.getRandomValues(buffer)
+            offset = 0
+        }
+        result = buffer[offset++]
+    } while (result >= rejectionThreshold)
+    return Number(bmin + result % rangeSize)
+}
+
+/**
+ * Returns a cryptographically secure random integer between min and max, inclusive.
+ *
+ * @param {number} minInclusive - the lowest integer in the desired range (inclusive)
+ * @param {number} maxInclusive - the highest integer in the desired range (inclusive)
+ * @returns {number} Random number
+ */
+
+export function getBrowserRandom(minInclusive, maxInclusive) {
+    const randomBuffer = new Uint32Array(1);
+    const cr = (window.crypto || window.msCrypto);
+    cr?.getRandomValues(randomBuffer);
+    const r = cr ? ( randomBuffer[0] / (0xffffffff + 1) ) : getRand();
+    return Math.floor(r * (maxInclusive - minInclusive + 1) + minInclusive);
+}
 
 export function randomDate(start, end) {
     return new Date(start.getTime() + Math.random() * (end.getTime() - start.getTime()));

package/src/engine.js

@@ -4,7 +4,12 @@ import fs from 'node:fs'
 import express from 'express'
 import {MongoClient as InternalMongoClient} from 'mongodb'
 import process from "process";
-import {cookiesSecret, dbName} from "./constants.js";
+import {
+    cookiesSecret,
+    databasePoolSize,
+    dbName,
+    tlsAllowInvalidCertificates, tlsAllowInvalidHostnames
+} from "./constants.js";
 import http from "http";
 import cookieParser from "cookie-parser";
 import requestIp from 'request-ip';
@@ -13,13 +18,40 @@ import {defaultModels} from "./defaultModels.js";
 import {DefaultUserProvider} from "./providers.js";
 import formidableMiddleware from 'express-formidable';
 import sirv from "sirv";
+import * as tls from "node:tls";
 
 // Constants
 const isProduction = process.env.NODE_ENV === 'production'
 
+let caFile, certFile, keyFile;
+try {
+    if (process.env.CA_CERT)
+        caFile = fs.readFileSync(process.env.CA_CERT);
+} catch (e) {}
+try {
+    if (process.env.CERT)
+        certFile = fs.readFileSync(process.env.CERT);
+}catch (e) {}
+try{
+    if (process.env.CERT_KEY)
+        keyFile = fs.readFileSync(process.env.CERT_KEY);
+} catch (e) {}
+
+const secureContext = tls.createSecureContext({
+    ca: caFile, cert: certFile, key: keyFile
+});
+
+const isTlsActive = !(!process.env.TLS || ["0", "false"].includes(process.env.TLS.toLowerCase()));
+
 // Connection URL
 export const dbUrl = process.env.CI ? 'mongodb://mongodb:27017' : (process.env.MONGO_DB_URL || 'mongodb://127.0.0.1:27017');
-export const MongoClient = new InternalMongoClient(dbUrl, { maxPoolSize: 20 });
+export const MongoClient = new InternalMongoClient(dbUrl, {
+    maxPoolSize: databasePoolSize,
+    tls: isTlsActive,
+    secureContext,
+    tlsAllowInvalidCertificates,
+    tlsAllowInvalidHostnames
+});
 
 // Database Name
 export const MongoDatabase = MongoClient.db(dbName);
@@ -150,7 +182,7 @@ export const Engine = {
                         throw err;
                     }
                 });
-                process.exit(0);
+                process.exit(1);
             });
         }
 

package/src/migrate.js

@@ -3,16 +3,15 @@
 import process from "node:process";
 import fs from "node:fs/promises";
 import path from "node:path";
-// FIX: Import 'pathToFileURL' instead of 'fileURLToPath'
 import { pathToFileURL } from 'node:url';
 import { Engine, MongoDatabase } from "./engine.js";
 import { Logger } from "./gameObject.js";
 import { Config } from "./config.js";
-import chalk from "chalk"; // Pour une sortie plus lisible. Assurez-vous que 'chalk' est dans vos dépendances.
+import chalk from "chalk";
 
 // Configuration de base
 Config.Set("modules", ["mongodb"]);
-const MIGRATIONS_DIR = path.resolve(process.cwd(), 'server', 'src', 'migrations');
+const MIGRATIONS_DIR = path.resolve(process.cwd(), 'migrations');
 const MIGRATIONS_COLLECTION = 'migrations_log';
 
 const engine = await Engine.Create();

package/src/modules/data.js

@@ -1635,9 +1635,9 @@ export async function onInit(defaultEngine) {
     engine.put('/api/model/:id', [middlewareAuthenticator, userInitiator, setTimeoutMiddleware(15000)], async (req, res) => {
         const result = await editModel(req.me, req.params.id, req.fields);
         if( result.success){
-            return res.status(result.statusCode || '200').json(result);
+            return res.status(result.statusCode || 200).json(result);
         }else{
-            return res.status(result.statusCode || '500').json(result);
+            return res.status(result.statusCode || 500).json(result);
         }
     });
 

package/src/modules/mongodb.js

@@ -13,15 +13,6 @@ export async function onInit(defaultEngine) {
 
     const isProduction = process.env.NODE_ENV === 'production'
 
-    let ca, cert, key;
-    try {
-        ca = fs.readFileSync('certs/mongodb-cert.crt');
-        cert = fs.readFileSync('certs/mongodb.pem');
-        key = fs.readFileSync(`certs/mongodb-cert.key`);
-    } catch (e) {
-
-    }
-
     modelsCollection = MongoDatabase.collection("models");
     datasCollection = MongoDatabase.collection("datas");
     filesCollection = MongoDatabase.collection("files");

package/src/migrations/20240522143000-content.js

@@ -1,20 +0,0 @@
-/**
- * Migration: setting content field to 'fr' in 'content' model
- * Created at: 2024-05-21T10:00:00.000Z
- */
-
-export const up = async (db) => {
-    const datasCollection = db.collection("datas");
-    const content = await datasCollection.find({ _model:"content"}).toArray();
-    await Promise.all(content.map(async (doc) => {
-        if (typeof(doc.html)==='string') {
-            const c = { "fr" : doc.html };
-            await datasCollection.updateOne({_id: doc._id}, {$set: {html: c}});
-        }
-    }));
-    console.log("Migration UP: setting content field to 'fr' in 'content' model");
-};
-
-export const down = async (db) => {
-    console.log("Migration DOWN: noting to do");
-};