data-primals-engine 1.4.1 → 1.4.3

package/src/modules/data/data.validation.js

@@ -0,0 +1,248 @@
+import {Event} from "../../events.js";
+import i18n from "../../i18n.js";
+import {allowedFields, maxFileSize, maxModelNameLength, maxStringLength} from "../../constants.js";
+import {getDefaultForType} from "../../data.js";
+
+import {dataTypes} from "./data.operations.js";
+import {Logger} from "../../gameObject.js";
+
+
+let engine, logger;
+export function onInit(defaultEngine) {
+    engine = defaultEngine;
+    logger = engine.getComponent(Logger);
+}
+
+export async function validateModelStructure(modelStructure) {
+    return await Event.Trigger("OnValidateModelStructure", "event", "system", modelStructure);
+}
+
+export const validateField = (field) => {
+
+    const allowedFieldTest = (fields) => {
+        // Check for unknown fields
+        const unknownFields = Object.keys(field).filter(f => ![...allowedFields, ...fields].includes(f));
+
+        if (unknownFields.length > 0) {
+            throw new Error(i18n.t('api.validate.unknowField', `Propriété(s) non reconnue(s): '{{0}}' pour le champ '{{1}}'`, [unknownFields.join(', '), field.name]));
+        }
+
+        const fieldInvalid = Object.keys(fields).find(f => JSON.stringify(field[f] || '').length > maxStringLength);
+        if (fieldInvalid) {
+            throw new Error(i18n.t('api.validate.invalidField', `Champ(s) non valide(s): '{{0}}'`, [fieldInvalid.name]));
+        }
+    }
+
+    // Check for required fields
+    if (!field.name || typeof field.name !== 'string') {
+        throw new Error(i18n.t('api.validate.requiredFieldString', "Le champ '{{0}}' est requis et doit être une chaîne de caractères.", ["name"]));
+    }
+    if (!field.type || typeof field.type !== 'string') {
+        throw new Error(i18n.t('api.validate.requiredFieldString', "Le champ '{{0}}' est requis et doit être une chaîne de caractères.", ["type"]));
+    }
+
+    // Check for specific field types
+    switch (field.type) {
+    case 'relation':
+        allowedFieldTest(['relation', 'multiple', 'relationFilter']);
+        if (!field.relation || typeof field.relation !== 'string' || field.relation.length > maxModelNameLength) {
+            throw new Error(i18n.t('api.validate.requiredFieldString', "Le champ '{{0}}' est requis et doit être une chaîne de caractères.", ["relation"]));
+        }
+        if (field.multiple !== undefined && typeof field.multiple !== 'boolean') {
+            throw new Error(i18n.t('api.validate.fieldBoolean', "L'attribut '{{0}}' doit être un booléen.", ["multiple"]));
+        }
+        if (field.relationFilter && typeof field.relationFilter !== 'object') {
+            throw new Error(i18n.t('api.validate.fieldObject', "L'attribut '{{0}}' doit être un objet.", ["relationFilter"]));
+        }
+        break;
+    case 'enum': {
+        allowedFieldTest(['items']);
+        if (!field.items || !Array.isArray(field.items) || field.items.length === 0) {
+            throw new Error(i18n.t('api.validate.fieldStringArray', "L'attribut '{{0}}' doit être un tableau de chaines de caractères.", ["items"]));
+        }
+        let id = field.items.findIndex(item => typeof item !== 'string');
+        if (id !== -1) {
+            throw new Error(i18n.t('api.validate.fieldString', "Le champ '{{0}}' doit être une chaîne de caractères.", ["items[" + id + "]"]));
+        }
+        break;
+    }
+    case 'number':
+        allowedFieldTest(['min', 'max', 'step', 'unit', 'delay', 'gauge', 'percent']);
+        if (field.min !== undefined && typeof field.min !== 'number') {
+            throw new Error(i18n.t('api.validate.fieldNumber', "L'attribut '{{0}}' doit être un nombre.", ["min"]));
+        }
+        if (field.max !== undefined && typeof field.max !== 'number') {
+            throw new Error(i18n.t('api.validate.fieldNumber', "L'attribut '{{0}}' doit être un nombre.", ["max"]));
+        }
+        if (field.max < field.min) {
+            throw new Error(i18n.t('api.validate.inferiorTo', "L'attribut '{{0}}' doit être inférieur à l'attribut '{{1}}'.", ["min", "max"]));
+        }
+        if (field.step !== undefined && typeof field.step !== 'number') {
+            throw new Error(i18n.t('api.validate.fieldNumber', "L'attribut '{{0}}' doit être un nombre.", ["step"]));
+        }
+        if (field.unit !== undefined && typeof field.unit !== 'string') {
+            throw new Error(i18n.t('api.validate.fieldString', "Le champ '{{0}}' doit être une chaîne de caractères.", ["unit"]));
+        }
+        if (field.delay !== undefined && typeof field.delay !== 'boolean') {
+            throw new Error(i18n.t('api.validate.fieldBoolean', "Le champ '{{0}}' doit être un booléen.", ["unit"]));
+        }
+        if (field.gauge !== undefined && typeof field.gauge !== 'boolean') {
+            throw new Error(i18n.t('api.validate.fieldBoolean', "L'attribut '{{0}}' doit être un booléen.", ["gauge"]));
+        }
+        if (field.percent !== undefined && typeof field.percent !== 'boolean') {
+            throw new Error(i18n.t('api.validate.fieldBoolean', "L'attribut '{{0}}' doit être un booléen.", ["percent"]));
+        }
+        break;
+    case 'string':
+    case 'string_t':
+    case 'richtext':
+    case 'richtext_t':
+    case 'url':
+    case 'email':
+    case 'phone':
+    case 'password':
+    case 'code':
+        if (field.type === 'code')
+            allowedFieldTest(['maxlength', 'language', 'conditionBuilder', 'targetModel']);
+        else if (['string_t', 'string'].includes(field.type))
+            allowedFieldTest(['maxlength', 'multiline']);
+        else
+            allowedFieldTest(['maxlength']);
+        if (field.maxlength !== undefined && typeof field.maxlength !== 'number') {
+            throw new Error(i18n.t('api.validate.fieldNumber', "L'attribut '{{0}}' doit être un nombre.", ["maxlength"]));
+        }
+        break;
+    case 'model':
+    case 'modelField':
+        allowedFieldTest([]);
+        break;
+    case 'object':
+        allowedFieldTest([]);
+        break;
+    case 'boolean':
+        allowedFieldTest([]);
+        break;
+    case 'date':
+    case 'datetime': {
+        allowedFieldTest(['min', 'max']);
+        if (field.min !== undefined && typeof field.min !== 'string') {
+            throw new Error(i18n.t('api.validate.fieldString', "Le champ '{{0}}' doit être une chaîne de caractères.", ["min"]));
+        }
+        if (field.max !== undefined && typeof field.max !== 'string') {
+            throw new Error(i18n.t('api.validate.fieldString', "Le champ '{{0}}' doit être une chaîne de caractères.", ["max"]));
+        }
+        const dtMin = field.min ? new Date(field.min) : null;
+        const dtMax = field.max ? new Date(field.max) : null;
+        if (dtMin && dtMax && dtMin > dtMax) {
+            throw new Error(i18n.t('api.validate.inferiorTo', "L'attribut '{{0}}' doit être inférieur à l'attribut '{{1}}'.", ["min", "max"]));
+        }
+        break;
+    }
+    case 'image':
+    case 'file': {
+        allowedFieldTest(['mimeTypes', 'maxSize']);
+        if (field.mimeTypes !== undefined && !Array.isArray(field.mimeTypes)) {
+            throw new Error(i18n.t('api.validate.fieldStringArray', "L'attribut '{{0}}' doit être un tableau de chaines de caractères.", ["mimeTypes"]));
+        }
+        let id;
+        if (field.mimeTypes !== undefined && (id = field.mimeTypes.findIndex(item => typeof item !== 'string')) !== -1) {
+            throw new Error(i18n.t('api.validate.fieldString', "Le champ '{{0}}' doit être une chaîne de caractères.", ["mimeTypes[" + id + "]"]));
+        }
+        if (field.maxSize !== undefined && typeof field.maxSize !== 'number') {
+            throw new Error(i18n.t('api.validate.fieldNumber', "L'attribut '{{0}}' doit être un nombre.", ["maxSize"]));
+        }
+        if (field.maxSize !== undefined && field.maxSize > maxFileSize) {
+            throw new Error(i18n.t('api.validate.fileSize', `L'attribut 'maxSize' ne doit pas dépasser {{0}} octets.`, [maxFileSize]));
+        }
+        break;
+    }
+    case 'color':
+        allowedFieldTest([]);
+        return true;
+    case 'cronSchedule':
+        allowedFieldTest(['cronMask']);
+        return true;
+    case 'geolocation':
+        allowedFieldTest([]);
+        return true;
+    case 'calculated':
+        allowedFieldTest(['calculation']);
+        return true;
+    case 'array':
+        if (!field.itemsType || typeof field.itemsType !== 'string') {
+            throw new Error(i18n.t('api.validate.fieldString', "Le champ '{{0}}' doit être une chaîne de caractères.", ["itemsType"]));
+        }
+        if (!dataTypes[field.itemsType]) {
+            throw new Error(i18n.t('api.validate.invalidField', `Champ(s) non valide(s): '{{0}}'`, ["itemsType"]));
+        }
+        if (field.minItems !== undefined && typeof field.minItems !== 'number') {
+            throw new Error(i18n.t('api.validate.fieldNumber', "L'attribut '{{0}}' doit être un nombre.", ["minItems"]));
+        }
+        if (field.maxItems !== undefined && typeof field.maxItems !== 'number') {
+            throw new Error(i18n.t('api.validate.fieldNumber', "L'attribut '{{0}}' doit être un nombre.", ["maxItems"]));
+        }
+        break;
+    default:
+        throw new Error(i18n.t('api.validate.unknowType', `Le type '{{0}}' n'est pas reconnu.`, [field.type]));
+    }
+
+    // Check for optional fields
+    if (field.required !== undefined && typeof field.required !== 'boolean') {
+        throw new Error(i18n.t('api.validate.fieldBoolean', "L'attribut '{{0}}' doit être un booléen.", ["required"]));
+    }
+    if (field.hint !== undefined && typeof field.hint !== 'string') {
+        throw new Error(i18n.t('api.validate.fieldString', "Le champ '{{0}}' doit être une chaîne de caractères.", ["hint"]));
+    }
+    if (field.default !== undefined && field.default !== null && typeof field.default !== typeof getDefaultForType(field) && typeof field.default !== 'function') {
+        throw new Error(i18n.t('api.validate.sameType', `L'attribut '{{0}}' doit être du même type que l'attribut '{{0}}' (${field.type}).`, ['default', 'type']));
+    }
+    if (field.validate !== undefined && typeof field.validate !== 'function') {
+        throw new Error(i18n.t('api.validate.fieldFunction', "L'attribut '{{0}}' doit être une fonction.", ['validate']));
+    }
+    if (field.unique !== undefined && typeof field.unique !== 'boolean') {
+        throw new Error(i18n.t('api.validate.fieldBoolean', "L'attribut '{{0}}' doit être un booléen.", ["unique"]));
+    }
+    if (field.placeholder !== undefined && typeof field.placeholder !== 'string') {
+        throw new Error(i18n.t('api.validate.fieldString', "Le champ '{{0}}' doit être une chaîne de caractères.", ["placeholder"]));
+    }
+    if (field.asMain !== undefined && typeof field.asMain !== 'boolean') {
+        throw new Error(i18n.t('api.validate.fieldBoolean', "L'attribut '{{0}}' doit être un booléen.", ["asMain"]));
+    }
+    if (field.unit !== undefined && typeof field.unit !== 'string') {
+        throw new Error(i18n.t('api.validate.fieldString', "Le champ '{{0}}' doit être une chaîne de caractères.", ["unit"]));
+    }
+
+    return true;
+};
+
+/**
+ * Valide la structure et le contenu du document selon le modèle
+ */
+export async function validateModelData(doc, model, isPatch = false) {
+    if (!isPatch) {
+        model.fields.forEach(field => {
+            const value = doc[field.name];
+            if (field.required) {
+                if (value === undefined && !('default' in field)) {
+                    throw new Error(i18n.t('api.field.missingRequired', {field: field.name + " (" + model.name + ")"}));
+                }
+                if (value === '' || value === null) {
+                    throw new Error(i18n.t('api.field.requiredCannotBeEmpty', {field: field.name}));
+                }
+            }
+        });
+    }
+
+    // 2. Validation des types de champs (toujours exécutée pour les champs fournis)
+    for (const [fieldName, value] of Object.entries(doc)) {
+        const fieldDef = model.fields.find(f => f.name === fieldName);
+        if (!fieldDef) continue; // On ignore les champs supplémentaires
+
+        const validator = dataTypes[fieldDef.type]?.validate;
+        const valid = validator && validator(value, fieldDef);
+        const realValidation = await Event.Trigger('OnDataValidate', "event", "system", value, fieldDef, doc);
+        if (!(valid || realValidation)) {
+            throw new Error(i18n.t('api.field.validationFailed', {field: fieldName, value}));
+        }
+    }
+}

package/src/modules/data/index.js

@@ -1 +1,29 @@
-export * from './data.js';
+export * from './data.js';
+export {validateModelData} from "./data.validation.js";
+export {validateField} from "./data.validation.js";
+export {validateModelStructure} from "./data.validation.js";
+export {scheduleAlerts} from "./data.scheduling.js";
+export {runStatefulAlertJob} from "./data.scheduling.js";
+export {cancelAlerts} from "./data.scheduling.js";
+export {installAllPacks} from "./data.operations.js";
+export {installPack} from "./data.operations.js";
+export {exportData} from "./data.operations.js";
+export {importData} from "./data.operations.js";
+export {searchData} from "./data.operations.js";
+export {deleteData} from "./data.operations.js";
+export {editData} from "./data.operations.js";
+export {patchData} from "./data.operations.js";
+export {pushDataUnsecure} from "./data.operations.js";
+export {insertData} from "./data.operations.js";
+export {getModels} from "./data.operations.js";
+export {getModel} from "./data.operations.js";
+export {deleteModels} from "./data.operations.js";
+export {createModel} from "./data.operations.js";
+export {editModel} from "./data.operations.js";
+export {dataTypes} from "./data.operations.js";
+export {dumpUserData} from "./data.backup.js";
+export {loadFromDump} from "./data.backup.js";
+export {validateRestoreRequest} from "./data.backup.js";
+export {jobDumpUserData} from "./data.backup.js";
+export {handleCustomEndpointRequest} from "./data.routes.js";
+export {middlewareEndpointAuthenticator} from "./data.routes.js";

package/src/modules/user.js

@@ -14,6 +14,7 @@ import {Logger} from "../gameObject.js";
 import rateLimit from "express-rate-limit";
 import ivm from "isolated-vm";
 import {emailDefaultConfig} from "../constants.js";
+import {safeAssignObject} from "../core.js";
 
 export const userInitiator = async (req, res, next) => {
 
@@ -269,7 +270,7 @@ export async function calculateTotalUserStorageUsage(user) {
 export async function getEnv(user){
     const result = await searchData({ model: 'env' }, user);
     const envObject = result.data.reduce((acc, v) => {
-        acc[v.name] = v.value;
+        safeAssignObject(acc, v.name, v.value);
         return acc;
     }, {});
     return envObject;

package/src/modules/workflow.js

@@ -23,7 +23,7 @@ import {getHost} from "../constants.js";
 import {providers} from "./assistant/constants.js";
 import {ChatAnthropic} from "@langchain/anthropic";
 import {getAIProvider} from "./assistant/assistant.js";
-import {escapeRegex} from "../core.js";
+import {escapeRegex, safeAssignObject} from "../core.js";
 
 let logger = null;
 export async function onInit(defaultEngine) {
@@ -1143,7 +1143,8 @@ export async function substituteVariables(template, contextData, user) {
         const newObj = {};
         for (const key in template) {
             if (Object.prototype.hasOwnProperty.call(template, key)) {
-                newObj[key] = await substituteVariables(template[key], contextData, user);
+                const val = await substituteVariables(template[key], contextData, user);
+                safeAssignObject(newObj, key, val);
             }
         }
         return newObj;

package/src/services/stripe.js

@@ -1,6 +1,7 @@
 import Stripe from 'stripe';
 import {editData, insertData, searchData} from '../modules/data/index.js';
 import {getEnv} from "../modules/user.js";
+import {safeAssignObject} from "../core.js";
 
 const stripeInstances = {};
 
@@ -15,10 +16,10 @@ async function getStripeClient(user) {
     if (!stripeInstances[userId]) {
         const env = await getEnv(user);
         if (env.STRIPE_SECRET_KEY) {
-            stripeInstances[userId] = {
+            safeAssignObject(stripeInstances, userId, {
                 client: new Stripe(env.STRIPE_SECRET_KEY),
                 webhookSecret: env.STRIPE_WEBHOOK_SECRET
-            };
+            });
         }
     }
     return stripeInstances[userId] || null;

package/swagger-en.yml

@@ -599,6 +599,47 @@ components:
             description: ID of a token document
       required:
         - username
+    userPermission:
+      type: object
+      properties:
+        _id:
+          type: string
+          description: Unique document identifier (MongoDB ObjectId)
+          readOnly: true
+        _user:
+          type: string
+          description: Identifier of the user owning this document
+          readOnly: true
+        _model:
+          type: string
+          description: Name of the model this document belongs to
+          readOnly: true
+          default: userPermission
+        _hash:
+          type: number
+          description: Document hash for integrity verification
+          readOnly: true
+        _pack:
+          type: string
+          description: Name of the pack this document belongs to (if applicable)
+          readOnly: true
+        user:
+          type: string
+          description: ID of a user document
+        permission:
+          type: string
+          description: ID of a permission document
+        isGranted:
+          type: boolean
+          description: "True to grant the permission, False to revoke it explicitly."
+        expiresAt:
+          type: string
+          format: date-time
+          description: "If set, the exception (grant or revocation) is temporary."
+      required:
+        - user
+        - permission
+        - isGranted
     token:
       type: object
       properties:
@@ -792,6 +833,39 @@ components:
       required:
         - name
         - type
+    env:
+      type: object
+      properties:
+        _id:
+          type: string
+          description: Unique document identifier (MongoDB ObjectId)
+          readOnly: true
+        _user:
+          type: string
+          description: Identifier of the user owning this document
+          readOnly: true
+        _model:
+          type: string
+          description: Name of the model this document belongs to
+          readOnly: true
+          default: env
+        _hash:
+          type: number
+          description: Document hash for integrity verification
+          readOnly: true
+        _pack:
+          type: string
+          description: Name of the pack this document belongs to (if applicable)
+          readOnly: true
+        name:
+          type: string
+          description: ""
+        value:
+          type: string
+          description: ""
+      required:
+        - name
+        - type
     message:
       type: object
       properties:
@@ -864,6 +938,65 @@ components:
           description: ""
       required:
         - content
+    alert:
+      type: object
+      properties:
+        _id:
+          type: string
+          description: Unique document identifier (MongoDB ObjectId)
+          readOnly: true
+        _user:
+          type: string
+          description: Identifier of the user owning this document
+          readOnly: true
+        _model:
+          type: string
+          description: Name of the model this document belongs to
+          readOnly: true
+          default: alert
+        _hash:
+          type: number
+          description: Document hash for integrity verification
+          readOnly: true
+        _pack:
+          type: string
+          description: Name of the pack this document belongs to (if applicable)
+          readOnly: true
+        name:
+          type: string
+          description: ""
+        targetModel:
+          type: string
+          description: "The name of the model to target."
+        description:
+          type: string
+          description: ""
+        triggerCondition:
+          type: string
+          description: "The condition that, if met, will trigger the alert."
+        frequency:
+          type: string
+          description: "How often to check if the condition is met (CRON format)."
+        isActive:
+          type: boolean
+          default: true
+          description: ""
+        sendEmail:
+          type: boolean
+          default: false
+          description: "Check to also send an email notification."
+        lastNotifiedAt:
+          type: string
+          format: date-time
+          description: "Timestamp of the last notification sent for this alert."
+        message:
+          type: string
+          description: "Custom message for the email. If empty, a default message will be used. You can use variables like {count}, {alert.name}..."
+      required:
+        - name
+        - targetModel
+        - triggerCondition
+        - frequency
     webpage:
       type: object
       properties: