dbgate-api-premium 6.6.3 → 6.6.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dbgate-api-premium",
   "main": "src/index.js",
-  "version": "6.6.3",
+  "version": "6.6.4",
   "homepage": "https://dbgate.org/",
   "repository": {
     "type": "git",
@@ -30,10 +30,10 @@
     "compare-versions": "^3.6.0",
     "cors": "^2.8.5",
     "cross-env": "^6.0.3",
-    "dbgate-datalib": "^6.6.3",
-    "dbgate-query-splitter": "^4.11.5",
-    "dbgate-sqltree": "^6.6.3",
-    "dbgate-tools": "^6.6.3",
+    "dbgate-datalib": "^6.6.4",
+    "dbgate-query-splitter": "^4.11.7",
+    "dbgate-sqltree": "^6.6.4",
+    "dbgate-tools": "^6.6.4",
     "debug": "^4.3.4",
     "diff": "^5.0.0",
     "diff2html": "^3.4.13",
@@ -86,7 +86,7 @@
   "devDependencies": {
     "@types/fs-extra": "^9.0.11",
     "@types/lodash": "^4.14.149",
-    "dbgate-types": "^6.6.3",
+    "dbgate-types": "^6.6.4",
     "env-cmd": "^10.1.0",
     "jsdoc-to-markdown": "^9.0.5",
     "node-loader": "^1.0.2",

package/src/auth/authCommon.js

@@ -10,7 +10,13 @@ function getTokenSecret() {
   return tokenSecret;
 }
 
+function getStaticTokenSecret() {
+  // TODO static not fixed
+  return '14813c43-a91b-4ad1-9dcd-a81bd7dbb05f';
+}
+
 module.exports = {
   getTokenLifetime,
   getTokenSecret,
+  getStaticTokenSecret,
 };

package/src/auth/authProvider.js

@@ -10,6 +10,7 @@ const logger = getLogger('authProvider');
 
 class AuthProviderBase {
   amoid = 'none';
+  skipInList = false;
 
   async login(login, password, options = undefined, req = undefined) {
     return {
@@ -53,7 +54,11 @@ class AuthProviderBase {
   async getCurrentTablePermissions(req) {
     return [];
   }
-  
+
+  async getCurrentFilePermissions(req) {
+    return [];
+  }
+
   getLoginPageConnections() {
     return null;
   }

package/src/auth/storageAuthProvider.js

@@ -36,7 +36,18 @@ async function loadPermissionsForUserId(userId) {
   return [...getPredefinedPermissions('logged-user'), ...loggedUserPermissions, ...rolePermissions, ...userPermissions];
 }
 
+function getBuiltinRoleIdFromRequest(req) {
+  if (req?.auth?.amoid == 'superadmin') {
+    return -3;
+  }
+  if (req?.auth?.userId) {
+    return -2;
+  }
+  return -1;
+}
+
 class SuperadminAuthProvider extends AuthProviderBase {
+  skipInList = true;
   constructor() {
     super();
     this.amoid = 'superadmin';
@@ -58,6 +69,11 @@ class SuperadminAuthProvider extends AuthProviderBase {
     return tablePermissions;
   }
 
+  async getCurrentFilePermissions(req) {
+    const filePermissions = await readComplexRolePermissions(-3, 'role_files');
+    return filePermissions;
+  }
+
   async checkCurrentConnectionPermission(req, conid) {
     const res = await storageCheckRoleConnectionAccess(-3, conid);
     return res;
@@ -97,6 +113,12 @@ class StorageProviderBase extends AuthProviderBase {
     return tablePermissions;
   }
 
+  async getCurrentFilePermissions(req) {
+    const userId = this.getUserIdFromRequest(req);
+    const filePermissions = await readComplexUserRolePermissions(userId, 'user_files', 'role_files');
+    return filePermissions;
+  }
+
   async checkCurrentConnectionPermission(req, conid) {
     const userId = this.getUserIdFromRequest(req);
     const res = await storageCheckUserRoleConnectionAccess(userId, conid);
@@ -158,6 +180,11 @@ class AnonymousProvider extends StorageProviderBase {
     return tablePermissions;
   }
 
+  async getCurrentFilePermissions(req) {
+    const filePermissions = await readComplexRolePermissions(-1, 'role_files');
+    return filePermissions;
+  }
+
   async checkCurrentConnectionPermission(req, conid) {
     const res = await storageCheckRoleConnectionAccess(-1, conid);
     return res;
@@ -353,11 +380,10 @@ class OauthProvider extends StorageProviderBase {
     const scopeParam = this.config.oauthScope ? `&scope=${this.config.oauthScope}` : '';
     return {
       status: 'ok',
-      uri: `${this.config.oauthAuth}?client_id=${
-        this.config.oauthClient
-      }&response_type=code&redirect_uri=${encodeURIComponent(redirectUri)}&state=${encodeURIComponent(
-        state
-      )}${scopeParam}`,
+      uri: `${this.config.oauthAuth}?client_id=${this.config.oauthClient
+        }&response_type=code&redirect_uri=${encodeURIComponent(redirectUri)}&state=${encodeURIComponent(
+          state
+        )}${scopeParam}`,
     };
   }
 
@@ -537,6 +563,24 @@ class DatabaseProvider extends StorageProviderBase {
   }
 }
 
+function validateEmail(email) {
+  return String(email)
+    .toLowerCase()
+    .match(
+      /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|.(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/
+    );
+}
+
+function extractEmailFromMsEntraPayload(payload) {
+  for (const field of ['email', 'upn', 'unique_name']) {
+    const value = payload[field];
+    if (value && validateEmail(value)) {
+      return value;
+    }
+  }
+  return null;
+}
+
 class MsEntraProvider extends StorageProviderBase {
   constructor(config) {
     super(config);
@@ -555,7 +599,7 @@ class MsEntraProvider extends StorageProviderBase {
 
     logger.info({ payload }, 'DBGM-00004 User payload returned from MS Entra');
 
-    const { email } = payload;
+    const email = extractEmailFromMsEntraPayload(payload);
 
     const loginRows = await storageSelectFmt('select * from ~users where ~email = %v', email);
 
@@ -660,4 +704,5 @@ function createStorageAuthProvider(config) {
 module.exports = {
   createStorageAuthProvider,
   SuperadminAuthProvider,
+  getBuiltinRoleIdFromRequest
 };