expressa 1.0.5 → 1.1.3

package/.circleci/config.yml

@@ -2,7 +2,7 @@ version: 2
 jobs:
   build:
     docker:
-      - image: circleci/node:11.3.0
+      - image: circleci/node:16.13.0
     steps:
       - checkout
       - run:

package/auth/index.js

@@ -14,7 +14,11 @@ exports.doLogin = handler.doLogin
 
 exports.middleware = async function authMiddleware(req, res, next) {
   try {
-    const user = await handler.isLoggedIn(req)
+    req.query = req.query || {}
+    const token = req.query['token'] || req.headers['x-access-token']
+    delete req.query['token']
+    delete req.headers['x-access-token']
+    const user = await handler.isLoggedIn(token, req.getSetting('jwt_secret'))
     if (user) {
       req.uid = user._id
       req.ucollection = user.collection

package/auth/jwt.js

@@ -4,31 +4,27 @@ const util = require('../util')
 
 // User document already validated, created, and saved to database
 // The id of that document is given.
-exports.doLogin = function (user, req, collection, jwt_options = {}) {
-  if (!req.settings.jwt_secret) {
-    throw new util.ApiError(500, 'missing jwt_secret in settings')
+exports.doLogin = function (id, collection, jwt_secret, jwt_options = {}) {
+  if (!jwt_secret) {
+    throw new util.ApiError(500, 'missing jwt_secret')
   }
   const token = jwt.sign({
-    _id: user._id,
-    email: user.email,
+    _id: id,
     collection
-  }, req.settings.jwt_secret, jwt_options)
+  }, jwt_secret, jwt_options)
   return {
     token: token,
-    uid: user._id
+    uid: id
   }
 }
 
 // Returns the user id, or false if not logged in.
-exports.isLoggedIn = async function (req) {
-  if (!req.settings.jwt_secret) {
+exports.isLoggedIn = async function (token, jwt_secret) {
+  if (!jwt_secret) {
     return false
   }
-  req.query = req.query || {}
-  const token = req.query.token || req.headers['x-access-token']
-  delete req.query.token
   if (token) {
-    return jwt.verify(token, req.settings.jwt_secret)
+    return jwt.verify(token, jwt_secret)
   }
   return false
 }

package/controllers/install.js

@@ -13,7 +13,7 @@ exports.updateAdminPermissions = async function (api) {
     // expected if not installed
   }
   const neededPermissions = permissions.reduce((obj, p) => { obj[p] = 1; return obj }, {})
-  Object.assign(adminRole.permissions, neededPermissions)
+  adminRole.permissions = { ...neededPermissions, ...adminRole.permissions }
   await api.db.role.update('Admin', adminRole)
 }
 

package/controllers/status.js

@@ -29,6 +29,7 @@ exports.getStatus = function(router) {
     })
     listeners.sort((a, b) => a.priority - b.priority)
     const collections = Object.keys(router.db)
+      .filter((collection) => req.hasPermission(`${collection}: view`) || req.hasPermission(`${collection}: view own`))
     return {
       nodeVersion: process.version,
       uptime: util.friendlyDuration(process.uptime()),
@@ -39,4 +40,4 @@ exports.getStatus = function(router) {
       collections,
     }
   }
-}
+}

package/controllers/users.js

@@ -1,7 +1,7 @@
 const auth = require('../auth')
 const util = require('../util')
 const collectionsApi = require('./collections')
-const userPermissions = require('../middleware/users_permissions')
+const permissions = require('../middleware/permissions')
 
 exports.login = async (req, collection) => {
   const password = req.body.password
@@ -22,10 +22,10 @@ exports.login = async (req, collection) => {
     throw new util.ApiError(401, 'Incorrect password')
   }
   const jwt_options = req.settings.jwt_expires_in ? { expiresIn: req.settings.jwt_expires_in } : {}
-  const payload = auth.doLogin(user, req, collection, jwt_options)
+  const payload = auth.doLogin(user._id, collection, req.getSetting('jwt_secret'), jwt_options)
   req.uid = user._id
   req.ucollection = collection
-  await userPermissions.addRolePermissionsAsync(req)
+  await permissions.addRolePermissionsAsync(req)
   payload.canUseAdmin = req.hasPermission('login to admin')
   return payload
 }

package/index.js

@@ -17,7 +17,7 @@ const collectionsApi = require('./controllers/collections')
 const usersApi = require('./controllers/users')
 const installApi = require('./controllers/install')
 const statusApi = require('./controllers/status')
-const userPermissions = require('./middleware/users_permissions')
+const permissions = require('./middleware/permissions')
 const loggingMiddleware = require('./middleware/logging')
 
 process.env.NODE_ENV = process.env.NODE_ENV || 'development'
@@ -249,7 +249,7 @@ module.exports.api = function (settings) {
     }
 
     router.use(auth.middleware) // Add user id to request
-    router.use(userPermissions.middleware) // Add user and permissions to request
+    router.use(permissions.middleware) // Add user and permissions to request
 
     router.get('/status', ph(statusApi.getStatus(router)))
 

package/listeners_users.js

@@ -47,8 +47,7 @@ module.exports = async function(api) {
     }
   })
 
-  // TODO how to add back in the password on PUT?
-  api.addCollectionListenerWithPriority('get', loginCollections, -100, function hidePasswordHashes(req, collection, data) {
+  api.addCollectionListenerWithPriority(['get', 'changed', 'deleted'], loginCollections, 100, function hidePasswordHashes(req, collection, data) {
     if (!req.hasPermission(`${collection}: view hashed passwords`)) {
       debug(`deleting password because "${collection}: view hashed passwords"-permission is not set`)
       delete data.password

package/listeners_validation.js

@@ -16,6 +16,10 @@ ajv.addKeyword({
   type: 'string',
   schemaType: 'object',
 })
+ajv.addKeyword({
+  keyword: 'propertyOrder',
+  schemaType: 'number',
+})
 const formatKey = ajv.getKeyword('format')
 formatKey.type = formatKey.type.concat(['array', 'boolean', 'object'])
 

package/middleware/{users_permissions.js → permissions.js}

@@ -1,12 +1,12 @@
 const util = require('../util')
 
 async function addRolePermissions (req, roles) {
-  req.userPermissions = req.userPermissions || {}
+  req.permissions = req.permissions || {}
   const roleDocs = await Promise.all(roles.map((name) => req.db.role.get(name)))
   roleDocs.forEach((roleDoc) => {
     for (const permission in roleDoc.permissions) {
       if (roleDoc.permissions[permission]) {
-        req.userPermissions[permission] = true
+        req.permissions[permission] = true
       }
     }
   })
@@ -27,7 +27,7 @@ module.exports.addRolePermissionsAsync = async function addRolePermissionsMiddle
     req.hasPermission = () => true
     return
   }
-  req.hasPermission = (permission) => req.userPermissions && req.userPermissions[permission]
+  req.hasPermission = (permission) => req.permissions && req.permissions[permission]
   let roles = ['Anonymous']
   const isAuthenticatedRole = await doesAuthenticatedRoleExist(req)
   if (req.uid) {
@@ -39,7 +39,7 @@ module.exports.addRolePermissionsAsync = async function addRolePermissionsMiddle
       throw new util.ApiError(404, 'User no longer exists')
     }
   } else {
-    req.user = { permissions: {} }
+    req.user = {}
   }
   await addRolePermissions(req, roles)
 }

package/modules/admin/dist/index.html

@@ -1 +1 @@
-<!DOCTYPE html><html><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><script crossorigin src=https://cdnjs.cloudflare.com/ajax/libs/react/15.3.2/react.min.js></script><script crossorigin src=https://cdnjs.cloudflare.com/ajax/libs/react/15.3.2/react-dom.min.js></script><link href="https://fonts.googleapis.com/icon?family=Material+Icons" rel=stylesheet><script src=settings.js></script><title>Expressa Admin</title><link rel="shortcut icon" href=/admin/favicon.ico><link href=/admin/static/css/chunk-elementUI.3d004d9f.css rel=stylesheet><link href=/admin/static/css/chunk-libs.68e8d170.css rel=stylesheet><link href=/admin/static/css/app.9dd57eea.css rel=stylesheet></head><body><div id=app></div><script>!function(e){function n(n){for(var r,c,a=n[0],f=n[1],i=n[2],h=0,s=[];h<a.length;h++)c=a[h],Object.prototype.hasOwnProperty.call(u,c)&&u[c]&&s.push(u[c][0]),u[c]=0;for(r in f)Object.prototype.hasOwnProperty.call(f,r)&&(e[r]=f[r]);for(l&&l(n);s.length;)s.shift()();return o.push.apply(o,i||[]),t()}function t(){for(var e,n=0;n<o.length;n++){for(var t=o[n],r=!0,c=1;c<t.length;c++){var f=t[c];0!==u[f]&&(r=!1)}r&&(o.splice(n--,1),e=a(a.s=t[0]))}return e}var r={},c={runtime:0},u={runtime:0},o=[];function a(n){if(r[n])return r[n].exports;var t=r[n]={i:n,l:!1,exports:{}};return e[n].call(t.exports,t,t.exports,a),t.l=!0,t.exports}a.e=function(e){var n=[];c[e]?n.push(c[e]):0!==c[e]&&{"chunk-0884":1,"chunk-34ab":1,"chunk-3bc2":1,"chunk-5cee":1,"chunk-7291":1,"chunk-759b":1,"chunk-b423":1,"chunk-bd5f":1,"chunk-f116":1,"chunk-fb07":1}[e]&&n.push(c[e]=new Promise((function(n,t){for(var r="static/css/"+({}[e]||e)+"."+{"chunk-23bd":"31d6cfe0","chunk-0884":"40d0b632","chunk-34ab":"f9393b1e","chunk-3bc2":"89632b9d","chunk-5cee":"ce0e4bdb","chunk-7291":"13514e45","chunk-759b":"3a895a1e","chunk-b423":"5f239333","chunk-bd5f":"aefa49d7","chunk-e7c3":"31d6cfe0","chunk-f116":"2ff74e8a","chunk-fb07":"ac81d7d6"}[e]+".css",c=a.p+r,u=document.getElementsByTagName("link"),o=0;o<u.length;o++){var f=(h=u[o]).getAttribute("data-href")||h.getAttribute("href");if("stylesheet"===h.rel&&(f===r||f===c))return n()}var i=document.getElementsByTagName("style");for(o=0;o<i.length;o++){var h;if((f=(h=i[o]).getAttribute("data-href"))===r||f===c)return n()}var l=document.createElement("link");l.rel="stylesheet",l.type="text/css",l.onload=n,l.onerror=function(n){var r=n&&n.target&&n.target.src||c,u=new Error("Loading CSS chunk "+e+" failed.\n("+r+")");u.request=r,t(u)},l.href=c,document.getElementsByTagName("head")[0].appendChild(l)})).then((function(){c[e]=0})));var t=u[e];if(0!==t)if(t)n.push(t[2]);else{var r=new Promise((function(n,r){t=u[e]=[n,r]}));n.push(t[2]=r);var o,f=document.createElement("script");f.charset="utf-8",f.timeout=120,a.nc&&f.setAttribute("nonce",a.nc),f.src=function(e){return a.p+"static/js/"+({}[e]||e)+"."+{"chunk-23bd":"5fa24c85","chunk-0884":"5ca2b4c5","chunk-34ab":"06400cb6","chunk-3bc2":"028748b7","chunk-5cee":"a3b03f7a","chunk-7291":"590524e9","chunk-759b":"89a889b6","chunk-b423":"387c504c","chunk-bd5f":"e9509f10","chunk-e7c3":"e5df8ceb","chunk-f116":"b616ebb3","chunk-fb07":"075ac852"}[e]+".js"}(e);var i=new Error;o=function(n){f.onerror=f.onload=null,clearTimeout(h);var t=u[e];if(0!==t){if(t){var r=n&&("load"===n.type?"missing":n.type),c=n&&n.target&&n.target.src;i.message="Loading chunk "+e+" failed.\n("+r+": "+c+")",i.name="ChunkLoadError",i.type=r,i.request=c,t[1](i)}u[e]=void 0}};var h=setTimeout((function(){o({type:"timeout",target:f})}),12e4);f.onerror=f.onload=o,document.head.appendChild(f)}return Promise.all(n)},a.m=e,a.c=r,a.d=function(e,n,t){a.o(e,n)||Object.defineProperty(e,n,{enumerable:!0,get:t})},a.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},a.t=function(e,n){if(1&n&&(e=a(e)),8&n)return e;if(4&n&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(a.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&n&&"string"!=typeof e)for(var r in e)a.d(t,r,function(n){return e[n]}.bind(null,r));return t},a.n=function(e){var n=e&&e.__esModule?function(){return e.default}:function(){return e};return a.d(n,"a",n),n},a.o=function(e,n){return Object.prototype.hasOwnProperty.call(e,n)},a.p="/admin/",a.oe=function(e){throw console.error(e),e};var f=window.webpackJsonp=window.webpackJsonp||[],i=f.push.bind(f);f.push=n,f=f.slice();for(var h=0;h<f.length;h++)n(f[h]);var l=i;t()}([]);</script><script src=/admin/static/js/chunk-elementUI.b0c99c08.js></script><script src=/admin/static/js/chunk-libs.b6f27cfe.js></script><script src=/admin/static/js/app.5f6e0e4c.js></script></body></html>
+<!DOCTYPE html><html><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><script crossorigin src=https://cdnjs.cloudflare.com/ajax/libs/react/15.3.2/react.min.js></script><script crossorigin src=https://cdnjs.cloudflare.com/ajax/libs/react/15.3.2/react-dom.min.js></script><link href="https://fonts.googleapis.com/icon?family=Material+Icons" rel=stylesheet><script src=settings.js></script><title>Expressa Admin</title><link rel=icon href=/admin/favicon.ico><link href=/admin/static/css/chunk-elementUI.3d004d9f.css rel=stylesheet><link href=/admin/static/css/chunk-libs.327ad89e.css rel=stylesheet><link href=/admin/static/css/app.9dd57eea.css rel=stylesheet></head><body><div id=app></div><script>!function(e){function n(n){for(var r,c,a=n[0],i=n[1],f=n[2],h=0,d=[];h<a.length;h++)c=a[h],Object.prototype.hasOwnProperty.call(u,c)&&u[c]&&d.push(u[c][0]),u[c]=0;for(r in i)Object.prototype.hasOwnProperty.call(i,r)&&(e[r]=i[r]);for(l&&l(n);d.length;)d.shift()();return o.push.apply(o,f||[]),t()}function t(){for(var e,n=0;n<o.length;n++){for(var t=o[n],r=!0,c=1;c<t.length;c++){var i=t[c];0!==u[i]&&(r=!1)}r&&(o.splice(n--,1),e=a(a.s=t[0]))}return e}var r={},c={runtime:0},u={runtime:0},o=[];function a(n){if(r[n])return r[n].exports;var t=r[n]={i:n,l:!1,exports:{}};return e[n].call(t.exports,t,t.exports,a),t.l=!0,t.exports}a.e=function(e){var n=[];c[e]?n.push(c[e]):0!==c[e]&&{"chunk-1059":1,"chunk-3bc2":1,"chunk-418a":1,"chunk-5cee":1,"chunk-7291":1,"chunk-787e":1,"chunk-d0cd":1,"chunk-b423":1,"chunk-bd5f":1,"chunk-f075":1}[e]&&n.push(c[e]=new Promise((function(n,t){for(var r="static/css/"+({}[e]||e)+"."+{"chunk-1059":"220d4af5","chunk-3bc2":"89632b9d","chunk-418a":"5ee55031","chunk-5cee":"ce0e4bdb","chunk-7291":"13514e45","chunk-8bab":"31d6cfe0","chunk-787e":"1d849865","chunk-d0cd":"97323951","chunk-b423":"5f239333","chunk-bd5f":"aefa49d7","chunk-e7c3":"31d6cfe0","chunk-f075":"3a895a1e"}[e]+".css",c=a.p+r,u=document.getElementsByTagName("link"),o=0;o<u.length;o++){var i=(h=u[o]).getAttribute("data-href")||h.getAttribute("href");if("stylesheet"===h.rel&&(i===r||i===c))return n()}var f=document.getElementsByTagName("style");for(o=0;o<f.length;o++){var h;if((i=(h=f[o]).getAttribute("data-href"))===r||i===c)return n()}var l=document.createElement("link");l.rel="stylesheet",l.type="text/css",l.onload=n,l.onerror=function(n){var r=n&&n.target&&n.target.src||c,u=new Error("Loading CSS chunk "+e+" failed.\n("+r+")");u.request=r,t(u)},l.href=c,document.getElementsByTagName("head")[0].appendChild(l)})).then((function(){c[e]=0})));var t=u[e];if(0!==t)if(t)n.push(t[2]);else{var r=new Promise((function(n,r){t=u[e]=[n,r]}));n.push(t[2]=r);var o,i=document.createElement("script");i.charset="utf-8",i.timeout=120,a.nc&&i.setAttribute("nonce",a.nc),i.src=function(e){return a.p+"static/js/"+({}[e]||e)+"."+{"chunk-1059":"e6aa7b61","chunk-3bc2":"028748b7","chunk-418a":"e0987b3c","chunk-5cee":"a3b03f7a","chunk-7291":"590524e9","chunk-8bab":"7052832d","chunk-787e":"3ee96fce","chunk-d0cd":"1781b9dd","chunk-b423":"387c504c","chunk-bd5f":"e9509f10","chunk-e7c3":"e5df8ceb","chunk-f075":"315ceec1"}[e]+".js"}(e);var f=new Error;o=function(n){i.onerror=i.onload=null,clearTimeout(h);var t=u[e];if(0!==t){if(t){var r=n&&("load"===n.type?"missing":n.type),c=n&&n.target&&n.target.src;f.message="Loading chunk "+e+" failed.\n("+r+": "+c+")",f.name="ChunkLoadError",f.type=r,f.request=c,t[1](f)}u[e]=void 0}};var h=setTimeout((function(){o({type:"timeout",target:i})}),12e4);i.onerror=i.onload=o,document.head.appendChild(i)}return Promise.all(n)},a.m=e,a.c=r,a.d=function(e,n,t){a.o(e,n)||Object.defineProperty(e,n,{enumerable:!0,get:t})},a.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},a.t=function(e,n){if(1&n&&(e=a(e)),8&n)return e;if(4&n&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(a.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&n&&"string"!=typeof e)for(var r in e)a.d(t,r,function(n){return e[n]}.bind(null,r));return t},a.n=function(e){var n=e&&e.__esModule?function(){return e.default}:function(){return e};return a.d(n,"a",n),n},a.o=function(e,n){return Object.prototype.hasOwnProperty.call(e,n)},a.p="/admin/",a.oe=function(e){throw console.error(e),e};var i=window.webpackJsonp=window.webpackJsonp||[],f=i.push.bind(i);i.push=n,i=i.slice();for(var h=0;h<i.length;h++)n(i[h]);var l=f;t()}([]);</script><script src=/admin/static/js/chunk-elementUI.b0c99c08.js></script><script src=/admin/static/js/chunk-libs.06c38828.js></script><script src=/admin/static/js/app.4c984719.js></script></body></html>

package/modules/admin/dist/static/css/chunk-1059.220d4af5.css

@@ -0,0 +1 @@
+.el-table[data-v-1453a01e] th{background-color:#343a40!important;border-color:#454d55;color:#fff}

package/modules/admin/dist/static/css/{chunk-f116.2ff74e8a.css → chunk-418a.5ee55031.css}

@@ -1 +1 @@
-.el-table[data-v-a8e6aab2] th{background-color:#343a40!important;border-color:#454d55;color:#fff}.dashboard-container[data-v-5d163182]{margin:30px}.dashboard-text[data-v-5d163182]{font-size:30px;line-height:46px}a#settings-link[data-v-5d163182]{color:#35a;padding-left:25px}
+.el-table[data-v-1453a01e] th{background-color:#343a40!important;border-color:#454d55;color:#fff}.dashboard-container[data-v-5d163182]{margin:30px}.dashboard-text[data-v-5d163182]{font-size:30px;line-height:46px}a#settings-link[data-v-5d163182]{color:#35a;padding-left:25px}

package/modules/admin/dist/static/css/chunk-787e.1d849865.css

@@ -0,0 +1 @@
+.expandable-textarea{display:block;min-height:250px;min-width:250px;resize:both!important}.jsoneditor-vue img{border:1px solid #ddd;border-radius:4px;padding:5px;width:150px}.jsoneditor-vue img:hover{-webkit-box-shadow:0 0 2px 1px rgba(0,140,186,.5);box-shadow:0 0 2px 1px rgba(0,140,186,.5)}.jsoneditor-vue button.btn{font-size:14px!important;padding:3px}.jsoneditor-vue .form-control-label,label{font-weight:700}.jsoneditor-vue input[type=checkbox]{margin-right:5px;margin-top:3px}.comment-link{margin-top:-15px}.error-message{color:red}

package/modules/admin/dist/static/css/chunk-d0cd.97323951.css

@@ -0,0 +1 @@
+.expandable-textarea{display:block;min-height:250px;min-width:250px;resize:both!important}.jsoneditor-vue img{border:1px solid #ddd;border-radius:4px;padding:5px;width:150px}.jsoneditor-vue img:hover{-webkit-box-shadow:0 0 2px 1px rgba(0,140,186,.5);box-shadow:0 0 2px 1px rgba(0,140,186,.5)}.jsoneditor-vue button.btn{font-size:14px!important;padding:3px}.jsoneditor-vue .form-control-label,label{font-weight:700}.jsoneditor-vue input[type=checkbox]{margin-right:5px;margin-top:3px}.error-message[data-v-3c5b79e9]{color:red}