expressa 1.4.6 → 2.0.0

package/.eslintrc.json

@@ -20,7 +20,7 @@
         "xdescribe": true
     },
     "parserOptions": {
-        "ecmaVersion": 2018
+        "ecmaVersion": 2022
     },
     "env": {
         "es6": true,

package/controllers/collections.js

@@ -10,6 +10,55 @@ function assertValidCollection(req) {
   }
 }
 
+async function validateDocumentOwner(req, doc) {
+  if (!doc.meta.owner_collection) {
+    throw new util.ApiError(417, 'no owner_collection for owner found')
+  }
+  if (doc._id !== doc.meta.owner) {
+    const count = await req.db[doc.meta.owner_collection].count({ _id: doc.meta.owner }, undefined, 1)
+    if (!count) {
+      throw new util.ApiError(417, 'invalid owner')
+    }
+  } else if (req.params.collection !== doc.meta.owner_collection) {
+    throw new util.ApiError(417, 'invalid owner collection')
+  }
+}
+
+async function setDocumentOwner(req, doc) {
+  const schema = await req.db.collection.get(req.params.collection)
+  if (schema.documentsHaveOwners) {
+    util.addIdIfMissing(doc)
+    doc.meta ??= {}
+    if (req.uid) {
+      // request done by logged in user
+      if (!doc.meta.owner) {
+        // no owner - make logged in user as owner
+        doc.meta.owner = req.user._id
+        doc.meta.owner_collection = req.ucollection
+      } else {
+        if (!req.hasPermission(`${req.params.collection}: modify owner`)) {
+          // has an owner - but if no permission to modify owner then override owner to logged in user
+          doc.meta.owner = req.user._id
+          doc.meta.owner_collection = req.ucollection
+        }
+      }
+    } else {
+      // request done by NOT logged in user
+      if (schema.enableLogin) {
+        // is a user/login collection so make self owner
+        doc.meta.owner = doc._id
+        doc.meta.owner_collection = req.params.collection
+      } else {
+        // is a normal collection
+        debug('unable to find valid owner')
+      }
+    }
+    if (doc.meta.owner) {
+      await validateDocumentOwner(req, doc)
+    }
+  }
+}
+
 exports.getSchema = async function (req) {
   const collection = await req.db.collection.get(req.params.collection)
   await util.notify('get', req, 'schemas', collection)
@@ -23,13 +72,14 @@ exports.get = async function (req) {
   }
 
   const fields = req.query.fields ? JSON.parse(req.query.fields) : null
+  delete req.query.fields
 
   let data, query
   if (req.query.query) {
     query = JSON.parse(req.query.query)
   }
   else {
-    const { skip, offset, limit, page, pageitems, pagemetadisable, orderby, fields, ...params } = req.query // eslint-disable-line no-unused-vars
+    const { skip, offset, limit, page, pageitems, pagemetadisable, orderby, ...params } = req.query // eslint-disable-line no-unused-vars
     query = queryStringParser.parse(params)
   }
   if (req.query.orderby) {
@@ -41,7 +91,8 @@ exports.get = async function (req) {
     // scenario where logged in user can only retrieve own docs
     if (!req.hasPermission(`${req.params.collection}: view`) && req.hasPermission(`${req.params.collection}: view own`)) {
       query['meta.owner'] = req.uid
-      fields['meta.owner'] = 1
+      // if fields is null then all fields are requested
+      if (fields) fields['meta.owner'] = 1
     }
   }
 
@@ -94,7 +145,7 @@ exports.insert = async function (req) {
   const data = req.body
   req.customResponseData = req.customResponseData || {}
   await util.notify('post', req, req.params.collection, data)
-
+  await setDocumentOwner(req, data)
   const id = await req.db[req.params.collection].create(data)
   await util.notify('changed', req, req.params.collection, data)
   return {
@@ -145,16 +196,23 @@ exports.updateById = async function (req) {
 
   const doc = await req.db[req.params.collection].get(req.params.id)
   const owner = doc.meta && doc.meta.owner
+  const ownerCollection = doc.meta && doc.meta.owner_collection
   util.mongoUpdate(doc, modifier)
   const newOwner = doc.meta && doc.meta.owner
-  if (owner !== newOwner) {
-    debug('attempting to change document owner.')
-    doc.meta.owner = owner
+  const newOwnerCollection = doc.meta && doc.meta.owner_collection
+  if (owner !== newOwner || ownerCollection !== newOwnerCollection) {
+    if (req.hasPermission(`${req.params.collection}: modify owner`)) {
+      if (owner) {
+        await validateDocumentOwner(req, doc)
+      }
+    } else {
+      debug('attempting to change document owner.')
+      doc.meta.owner = owner
+      doc.meta.owner_collection = ownerCollection
+    }
   }
   req.body = doc
   await util.notify('put', req, req.params.collection, doc)
-
-  req.body.meta.owner = newOwner
   await req.db[req.params.collection].update(req.params.id, req.body)
   await util.notify('changed', req, req.params.collection, req.body)
   if (Object.keys(req.customResponseData)) {

package/controllers/users.js

@@ -1,50 +1,52 @@
-const auth = require('../auth')
-const util = require('../util')
-const collectionsApi = require('./collections')
-const permissions = require('../middleware/permissions')
-
-exports.login = async (req, collection) => {
-  const password = req.body.password
-
-  if (typeof req.body.email !== 'string') {
-    throw new util.ApiError(400, 'email must be a string')
-  }
-
-  // check if user exists
-  const result = await req.db[collection].find({
-    email: req.body.email
-  })
-  if (result.length === 0) {
-    throw new util.ApiError(400, 'No ' + collection + ' found with this email.')
-  }
-  const user = result[0]
-  if (!auth.isValidPassword(password, user.password)) {
-    throw new util.ApiError(401, 'Incorrect password')
-  }
-  const jwt_options = req.settings.jwt_expires_in ? { expiresIn: req.settings.jwt_expires_in } : {}
-  const payload = auth.doLogin({
-    id: user._id,
-    collection,
-    timestamp: user.meta.password_last_updated_at,
-    jwt_secret: req.getSetting('jwt_secret'),
-    jwt_options
-  })
-  req.uid = user._id
-  req.ucollection = collection
-  req.user = user
-  await permissions.addRolePermissionsAsync(req)
-  payload.canUseAdmin = req.hasPermission('login to admin')
-  return payload
-}
-
-exports.register = function (req, collection) {
-  req.url = `/${collection}`
-  req.params.collection = collection
-  return collectionsApi.insert(req)
-}
-
-exports.getMe = function (req, collection) {
-  req.params.collection = collection
-  req.params.id = req.uid
-  return collectionsApi.getById(req)
-}
+const auth = require('../auth')
+const util = require('../util')
+const collectionsApi = require('./collections')
+const permissions = require('../middleware/permissions')
+
+exports.login = async (req, collection) => {
+  const password = req.body.password
+
+  if (typeof req.body.email !== 'string') {
+    throw new util.ApiError(400, 'email must be a string')
+  }
+
+  req.body.email = req.body.email.toLowerCase()
+
+  // check if user exists
+  const result = await req.db[collection].find({
+    email: req.body.email
+  })
+  if (result.length === 0) {
+    throw new util.ApiError(400, 'No ' + collection + ' found with this email.')
+  }
+  const user = result[0]
+  if (!auth.isValidPassword(password, user.password)) {
+    throw new util.ApiError(401, 'Incorrect password')
+  }
+  const jwt_options = req.settings.jwt_expires_in ? { expiresIn: req.settings.jwt_expires_in } : {}
+  const payload = auth.doLogin({
+    id: user._id,
+    collection,
+    timestamp: user.meta.password_last_updated_at,
+    jwt_secret: req.getSetting('jwt_secret'),
+    jwt_options
+  })
+  req.uid = user._id
+  req.ucollection = collection
+  req.user = user
+  await permissions.addRolePermissionsAsync(req)
+  payload.canUseAdmin = req.hasPermission('login to admin')
+  return payload
+}
+
+exports.register = function (req, collection) {
+  req.url = `/${collection}`
+  req.params.collection = collection
+  return collectionsApi.insert(req)
+}
+
+exports.getMe = function (req, collection) {
+  req.params.collection = collection
+  req.params.id = req.uid
+  return collectionsApi.getById(req)
+}

package/listeners.js

@@ -18,19 +18,11 @@ module.exports = function (api) {
     Object.assign(req.settings, data)
   })
 
-  api.addListener(['put', 'post'], function updateMetadata (req, collection, data, { event }) {
-    data.meta = data.meta || {}
+  api.addListener(['put', 'post'], async function updateMetadata (req, collection, data, { event }) {
+    data.meta ??= {}
     data.meta.updated = new Date().toISOString()
     if (event === 'post') {
       data.meta.created = new Date().toISOString()
-      if (req.user) {
-        if (req.hasPermission('login to admin')) {
-          data.meta.owner = data.meta.owner || req.user._id
-        }
-        else {
-          data.meta.owner = req.user._id
-        }
-      }
     }
   })
 
@@ -63,6 +55,9 @@ module.exports = function (api) {
               class: 'comment-link'
             }
           ]
+        },
+        schema.properties.meta.properties.owner_collection = {
+          type: 'string'
         }
       }
     }

package/listeners_collection_permissions.js

@@ -19,11 +19,8 @@ module.exports = function (api) {
 
   api.addListener(['get', 'put', 'post', 'delete'], function collectionPermissionCheck (req, collection, data, info) {
     const permission = eventToPermissionMapping[info.event]
-    const editingSelf = collection === req.ucollection && data._id === req.uid
     const editingOwnDoc = data.meta && data.meta.owner && data.meta.owner === req.uid
-    const editingOwn = ((editingSelf || editingOwnDoc) &&
-      req.hasPermission(collection + ': ' + permission + ' own'))
-    // console.log(editingOwn + ' ' + editingSelf + ' ' + editingOwnDoc);
+    const editingOwn = editingOwnDoc && req.hasPermission(collection + ': ' + permission + ' own')
     if (!editingOwn && !req.hasPermission(collection + ': ' + permission)) {
       debug(`cancelling, missing permission "${collection}: ${permission}"`)
       throw new util.ApiError(401, 'You do not have permission to perform this action.')

package/listeners_users.js

@@ -1,88 +1,92 @@
-const auth = require('./auth')
-const util = require('./util.js')
-const debug = require('debug')('expressa')
-
-module.exports = async function(api) {
-
-  const loginCollections = (await util.getLoginCollections(api)).map((coll) => coll._id)
-
-  api.addCollectionListener(['post', 'put'], loginCollections, async function updatePassword(req, collection, data) {
-    if (req.method === 'PUT') {
-      if (!data.password) {
-        const oldData = await api.db[collection].get(data._id)
-        data.password = oldData.password // preserve password if not explicitly set
-      }
-    }
-    if (data.password && data.password.length !== 60 && data.password[0] !== '$') {
-      debug('hashing and replacing password in the user document.')
-      data.password = auth.createHash(data.password)
-      data.meta.password_last_updated_at = new Date().toISOString()
-    }
-  })
-
-  api.addCollectionListener('post', loginCollections, async function roleCreateCheck(req, collection, data) {
-    if (!data.roles) {
-      data.roles = []
-    }
-    // user special case to allow first user to be admin
-    if (collection === 'users') {
-      const hasUsers = (await api.db.users.find({}, 0, 1)).length === 1
-      if (!hasUsers && !data.roles.includes('Admin')) {
-        throw new util.ApiError(400, 'first user must have role Admin')
-      }
-      if (hasUsers && data.roles.length > 0 && !req.hasPermission('users: modify roles')) {
-        throw new util.ApiError(400, 'insufficient permissions to create user with roles')
-      }
-    }
-    else {
-      if (data.roles.length > 0 && !req.hasPermission(`${collection}: modify roles`)) {
-        throw new util.ApiError(400, `insufficient permissions to create ${collection} with roles`)
-      }
-    }
-  })
-
-  api.addLateCollectionListener('put', loginCollections, async function roleChangeCheck(req, collection, data) {
-    if (!req.hasPermission(`${collection}: modify roles`)) {
-      const oldData = await api.db[collection].get(data._id)
-      data.roles = oldData.roles
-    }
-  })
-
-  api.addCollectionListenerWithPriority(['get', 'changed', 'deleted'], loginCollections, 100, function hidePasswordHashes(req, collection, data) {
-    if (!req.hasPermission(`${collection}: view hashed passwords`)) {
-      debug(`deleting password because "${collection}: view hashed passwords"-permission is not set`)
-      delete data.password
-    }
-  })
-
-  api.addCollectionListener('post', loginCollections, async function userUniquenessCheck(req, collection, data) {
-    const result = await api.db[collection].find({email: data.email})
-    if (result.length > 0) {
-      throw new util.ApiError(409, 'This email is already registered.')
-    }
-  })
-
-  /* Mantain users-roles reference */
-  api.addCollectionListener('changed', 'role', async function addRoleToUserSchema(req, collection, data) {
-    for (const coll of loginCollections) {
-      const doc = await api.db.collection.get(coll)
-      if (!doc.schema.properties.roles.items.enum.includes(data._id)) {
-        doc.schema.properties.roles.items.enum.push(data._id)
-        await api.db.collection.update(coll, doc)
-        await api.notify('changed', req, coll, doc)
-      }
-    }
-  })
-
-  api.addCollectionListener('deleted', 'role', async function removeRoleToUserSchema(req, collection, data) {
-    for (const coll of loginCollections) {
-      const doc = await api.db.collection.get(coll)
-      const roles = doc.schema.properties.roles.items.enum
-      if (roles.includes(data._id)) {
-        roles.splice(roles.indexOf(data._id), 1)
-        await api.db.collection.update(coll, doc)
-        await api.notify('changed', req, coll, doc)
-      }
-    }
-  })
-}
+const auth = require('./auth')
+const util = require('./util.js')
+const debug = require('debug')('expressa')
+
+module.exports = async function(api) {
+
+  const loginCollections = (await util.getLoginCollections(api)).map((coll) => coll._id)
+
+  api.addCollectionListener(['post', 'put'], loginCollections, async function updatePassword(req, collection, data) {
+    if (req.method === 'PUT') {
+      if (!data.password) {
+        const oldData = await api.db[collection].get(data._id)
+        data.password = oldData.password // preserve password if not explicitly set
+      }
+    }
+    if (data.password && data.password.length !== 60 && data.password[0] !== '$') {
+      debug('hashing and replacing password in the user document.')
+      data.password = auth.createHash(data.password)
+      data.meta.password_last_updated_at = new Date().toISOString()
+    }
+  })
+
+  api.addCollectionListener('post', loginCollections, async function roleCreateCheck(req, collection, data) {
+    if (!data.roles) {
+      data.roles = []
+    }
+    // user special case to allow first user to be admin
+    if (collection === 'users') {
+      const hasUsers = (await api.db.users.find({}, 0, 1)).length === 1
+      if (!hasUsers && !data.roles.includes('Admin')) {
+        throw new util.ApiError(400, 'first user must have role Admin')
+      }
+      if (hasUsers && data.roles.length > 0 && !req.hasPermission('users: modify roles')) {
+        throw new util.ApiError(400, 'insufficient permissions to create user with roles')
+      }
+    }
+    else {
+      if (data.roles.length > 0 && !req.hasPermission(`${collection}: modify roles`)) {
+        throw new util.ApiError(400, `insufficient permissions to create ${collection} with roles`)
+      }
+    }
+  })
+
+  api.addLateCollectionListener('put', loginCollections, async function roleChangeCheck(req, collection, data) {
+    if (!req.hasPermission(`${collection}: modify roles`)) {
+      const oldData = await api.db[collection].get(data._id)
+      data.roles = oldData.roles
+    }
+  })
+
+  api.addCollectionListenerWithPriority(['get', 'changed', 'deleted'], loginCollections, 100, function hidePasswordHashes(req, collection, data) {
+    if (!req.hasPermission(`${collection}: view hashed passwords`)) {
+      debug(`deleting password because "${collection}: view hashed passwords"-permission is not set`)
+      delete data.password
+    }
+  })
+
+  api.addCollectionListener(['post', 'put'], loginCollections, async function userEmailLowerCase(req, collection, data) {
+    data.email = data.email.toLowerCase()
+  })
+
+  api.addCollectionListener('post', loginCollections, async function userUniquenessCheck(req, collection, data) {
+    const result = await api.db[collection].find({email: data.email})
+    if (result.length > 0) {
+      throw new util.ApiError(409, 'This email is already registered.')
+    }
+  })
+
+  /* Mantain users-roles reference */
+  api.addCollectionListener('changed', 'role', async function addRoleToUserSchema(req, collection, data) {
+    for (const coll of loginCollections) {
+      const doc = await api.db.collection.get(coll)
+      if (!doc.schema.properties.roles.items.enum.includes(data._id)) {
+        doc.schema.properties.roles.items.enum.push(data._id)
+        await api.db.collection.update(coll, doc)
+        await api.notify('changed', req, 'collection', doc)
+      }
+    }
+  })
+
+  api.addCollectionListener('deleted', 'role', async function removeRoleToUserSchema(req, collection, data) {
+    for (const coll of loginCollections) {
+      const doc = await api.db.collection.get(coll)
+      const roles = doc.schema.properties.roles.items.enum
+      if (roles.includes(data._id)) {
+        roles.splice(roles.indexOf(data._id), 1)
+        await api.db.collection.update(coll, doc)
+        await api.notify('changed', req, 'collection', doc)
+      }
+    }
+  })
+}

package/listeners_validation.js

@@ -1,78 +1,43 @@
-const Ajv = require('ajv')
-const ajv = new Ajv({
-  allErrors: true,
-  strict: 'log',
-  strictSchema: 'log',
-  validateFormats: false,
-  allowUnionTypes: true,
-})
-ajv.addKeyword({
-  keyword: 'links',
-  type: 'string',
-  schemaType: 'array',
-})
-ajv.addKeyword({
-  keyword: 'media',
-  type: 'string',
-  schemaType: 'object',
-})
-ajv.addKeyword({
-  keyword: 'propertyOrder',
-  schemaType: 'number',
-})
-const formatKey = ajv.getKeyword('format')
-formatKey.type = formatKey.type.concat(['array', 'boolean', 'object'])
-
-const util = require('./util')
-const schemaValidators = {}
-
-function addImplicitFields (schema) {
-  schema['properties'] = schema['properties'] || {}
-  schema['properties']['meta'] = schema['properties']['meta'] || { type: 'object' }
-  schema['properties']['meta']['properties'] = schema['properties']['meta']['properties'] || {}
-  schema['properties']['meta']['properties']['created'] = schema['properties']['meta']['properties']['created'] ||
-      { type: 'string' }
-  schema['properties']['meta']['properties']['updated'] = schema['properties']['meta']['properties']['updated'] ||
-      { type: 'string' }
-  schema['properties']['meta']['properties']['owner'] = schema['properties']['meta']['properties']['owner'] ||
-      { type: 'string' }
-  schema['properties']['_id'] = schema['properties']['_id'] || { type: 'string' }
-  return schema
-}
-
-module.exports = async function (api) {
-
-  // Load all validators
-  const collections = await api.db.collection.all()
-  collections.forEach((collection) => {
-    const schema = addImplicitFields(collection.schema)
-    schemaValidators[collection._id] = ajv.compile(schema)
-  })
-
-  // Load new and update validators as necessary
-  api.addCollectionListener('changed', 'collection', function updateSchemaValidators (req, collection, data) {
-    const schema = addImplicitFields(data.schema)
-    schemaValidators[data._id] = ajv.compile(schema)
-  })
-
-  api.addCollectionListener('get', ['collection', 'schemas'], function ensureIdAdded (req, collection, data) {
-    if (data.schema) {
-      data.schema = addImplicitFields(data.schema)
-    }
-  })
-
-  api.addListener(['put', 'post'], function matchesSchema (req, collection, data) {
-    // TODO (switch to check if "installed" after install tests are done.
-    if (!req.settings.enforce_permissions) {
-      return
-    }
-    if (!schemaValidators[collection]) {
-      console.error(`missing schema validator for collection ${collection}`)
-      return true
-    }
-    const isValid = schemaValidators[collection](data)
-    if (!isValid) {
-      throw new util.ApiError(400, schemaValidators[collection].errors.map((err) => `${err.instancePath} ${err.message}: ${JSON.stringify(err.params)}`).join(', '))
-    }
-  })
-}
+const util = require('./util')
+
+function addImplicitFields (schema) {
+  schema['properties'] ??= {}
+  schema['properties']['meta'] ??= { type: 'object' }
+  schema['properties']['meta']['properties'] ??= {}
+  schema['properties']['meta']['properties']['created'] ??= { type: 'string' }
+  schema['properties']['meta']['properties']['updated'] ??= { type: 'string' }
+  schema['properties']['meta']['properties']['owner'] ??= { type: 'string' }
+  schema['properties']['meta']['properties']['owner_collection'] ??= { type: 'string' }
+  schema['properties']['_id'] ??= { type: 'string' }
+  return schema
+}
+
+module.exports = async function (api) {
+
+  // Load all validators
+  const collections = await api.db.collection.all()
+  collections.forEach((collection) => {
+    const schema = addImplicitFields(collection.schema)
+    util.addSchemaValidator(collection._id, schema)
+  })
+
+  // Load new and update validators as necessary
+  api.addCollectionListener('changed', 'collection', function updateSchemaValidators (req, collection, data) {
+    const schema = addImplicitFields(data.schema)
+    util.addSchemaValidator(data._id, schema)
+  })
+
+  api.addCollectionListener('get', ['collection', 'schemas'], function ensureIdAdded (req, collection, data) {
+    if (data.schema) {
+      data.schema = addImplicitFields(data.schema)
+    }
+  })
+
+  api.addListener(['put', 'post'], function matchesSchema (req, collection, data) {
+    // TODO (switch to check if "installed" after install tests are done.
+    if (!req.settings.enforce_permissions) {
+      return
+    }
+    util.validateSchema(collection, data)
+  })
+}

package/modules/collections/collections.js

@@ -1,11 +1,19 @@
 function getCollectionPermissions (name, hasOwner) {
-  let permissions = ['create', 'view', 'edit', 'delete'].map((action) => `${name}: ${action}`)
+  let permissions = exports.collectionPermissions(name)
   if (hasOwner) {
-    permissions = permissions.concat(['view', 'edit', 'delete'].map((action) => `${name}: ${action} own`))
+    permissions = permissions.concat(exports.collectionOwnerPermissions(name))
   }
   return permissions
 }
 
+exports.collectionPermissions = function (name) {
+  return ['create', 'view', 'edit', 'modify owner', 'delete'].map((action) => `${name}: ${action}`)
+}
+
+exports.collectionOwnerPermissions = function (name) {
+  return ['view', 'edit', 'delete'].map((action) => `${name}: ${action} own`)
+}
+
 exports.permissions = async function (app) {
   const collections = (await app.db.collection.all()).map((collection) => collection._id)
   // flatten the permissions into a single list

package/modules/permissions/permissions.js

@@ -1,3 +1,5 @@
+const { collectionPermissions, collectionOwnerPermissions } = require('../collections/collections')
+
 exports.settingSchema = {
   enforce_permissions: {
     type: 'boolean',
@@ -57,14 +59,6 @@ exports.install = async function (app) {
 
 exports.permissions = ['users: modify roles', 'login to admin']
 
-function collectionPermissions (name) {
-  return ['create', 'view', 'edit', 'delete'].map((action) => `${name}: ${action}`)
-}
-
-function collectionOwnerPermissions (name) {
-  return ['view', 'edit', 'delete'].map((action) => `${name}: ${action} own`)
-}
-
 exports.init = async function (api) {
   api.addCollectionListener(['changed'], 'collection', async function addCollectionPerms (req, collection, data) {
     if (api.db.role) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expressa",
-  "version": "1.4.6",
+  "version": "2.0.0",
   "description": "API framework using JSON schemas",
   "main": "index.js",
   "repository": "https://github.com/thomas4019/expressa",

package/test/0-install.js

@@ -63,6 +63,17 @@ describe('install flow', function () {
     expect(u.roles || []).to.include('Admin')
   })
 
+  it('can login admin account', async function() {
+    const res = await request(app)
+      .post('/users/login')
+      .send({
+        email: 'a@example.com',
+        password: '123'
+      })
+      .expect(200)
+    testutils.setAdminToken(res.body.token)
+  })
+
   it('2nd account cannot be admin account', async function() {
     await request(app)
       .post('/users/register')

package/test/collections.querying.js

@@ -11,7 +11,7 @@ const { app, api } = testutils
  */
 describe('querying collections', function () {
   it('create doc 1', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: create')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: create')
     await request(app)
       .post('/testdoc')
       .set('x-access-token', token)
@@ -28,7 +28,7 @@ describe('querying collections', function () {
   })
 
   it('create doc 2', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: create')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: create')
     await request(app)
       .post('/testdoc')
       .set('x-access-token', token)
@@ -42,7 +42,7 @@ describe('querying collections', function () {
   })
 
   it('create doc 3', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: create')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: create')
     await request(app)
       .post('/testdoc')
       .set('x-access-token', token)
@@ -60,7 +60,7 @@ describe('querying collections', function () {
   let token
 
   it('read doc by id', async function () {
-    token = await util.getUserWithPermissions(api, 'testdoc: view')
+    token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc/testid123')
       .set('x-access-token', token)
@@ -202,7 +202,7 @@ describe('querying collections', function () {
   })
 
   it('sort by deep field ascending', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: view')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc?orderby={"data.number":1}')
       .set('x-access-token', token)
@@ -214,7 +214,7 @@ describe('querying collections', function () {
   })
 
   it('sort by deep field descending', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: view')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc?orderby={"meta.created":-1}')
       .set('x-access-token', token)
@@ -226,7 +226,7 @@ describe('querying collections', function () {
   })
 
   it('project a specific field', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: view')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc?fields={"title":1}')
       .set('x-access-token', token)
@@ -237,7 +237,7 @@ describe('querying collections', function () {
   })
 
   it('project a specific field on get', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: view')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc/test1?fields={"title":1}')
       .set('x-access-token', token)
@@ -247,7 +247,7 @@ describe('querying collections', function () {
   })
 
   it('project deep fields', async function() {
-    const token = await util.getUserWithPermissions(api, 'testdoc: view')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc?fields={"data":1}')
       .set('x-access-token', token)
@@ -266,4 +266,4 @@ describe('querying collections', function () {
     expect(res2.body[0].data.number).to.equal(0)
     expect(res2.body[0].data.field).to.be.undefined
   })
-})
+})

package/test/test.js

@@ -70,7 +70,7 @@ describe('General Tests:', () => {
       res.send(req.user)
     })
 
-    const token = await util.getUserWithPermissions(api, [])
+    const token = await testutils.getUserWithPermissions(api, [])
     const res = await request(app)
       .get('/test')
       .set('x-access-token', token)

package/test/testutils.js

@@ -1,6 +1,7 @@
 const fs = require('fs')
 
 const expressa = require('../')
+const request = require('supertest')
 const util = require('../util')
 
 // See https://stackoverflow.com/questions/18052762/remove-directory-which-is-not-empty
@@ -25,11 +26,62 @@ exports.api = expressa.api({
   file_storage_path: 'testdata'
 })
 const express = require('express')
+const randomstring = require('randomstring')
 exports.app = express()
 exports.app.use(exports.api)
 
-exports.getUserWithPermissions = util.getUserWithPermissions
+const tokens = {
+  admin: ''
+}
+
+exports.setAdminToken = function(token) {
+  tokens.admin = token
+}
+
+exports.getUserWithPermissions = async function(api, permissions) {
+  const service = request(exports.app)
+  if (typeof permissions === 'string') {
+    permissions = [permissions]
+  }
+  permissions = permissions || []
+  const permissionsMap = {}
+  permissions.forEach(function (permission) {
+    permissionsMap[permission] = true
+  })
+
+  const randId = randomstring.generate(12)
+  const roleName = 'role' + randId
+  const role = {
+    _id: roleName,
+    permissions: permissionsMap
+  }
+
+  const roleRes = await service.post('/role')
+    .set('x-access-token', tokens.admin)
+    .send(role)
+    .expect(200)
+
+  const user = {
+    email: 'test' + randId + '@example.com',
+    password: '123',
+  }
+  const registerRes = await service.post('/users/register')
+    .send(user)
+    .expect(200)
+
+  const updateRes = await service.post(`/users/${registerRes.body.id}/update`)
+    .send({ $push: { roles: roleName } })
+    .set('x-access-token', tokens.admin)
+    .expect(200)
+
+  const loginRes = await service.post('/users/login')
+    .send(user)
+    .expect(200)
+
+  user._id = loginRes.body.uid
+  return loginRes.body.token
+}
 exports.clone = util.clone
 exports.sleep = function sleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms))
-}
+}

package/test/users.js

@@ -189,4 +189,123 @@ describe('user functionality', function () {
       .expect(200)
     expect(res3.body.properties.roles.items.enum).to.not.include('testrole')
   })
+
+  it('cannot change owner by default', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    await request(app)
+      .post(`/users/${newUser._id}/update`)
+      .set('x-access-token', token)
+      .send({ $set: { 'meta.owner': user._id } }) // try change owner to another user
+      .expect(200) // will succeed but owner will not change
+
+    const res2 = await request(app)
+      .get(`/users/${newUser._id}`)
+      .set('x-access-token', token)
+    expect(res2.body.meta.owner).to.not.equal(user._id)
+    expect(res2.body.meta.owner).to.equal(newUser._id)
+
+  })
+
+  it('can change owner with correct permission', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'users: modify owner'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    await request(app)
+      .post(`/users/${newUser._id}/update`)
+      .set('x-access-token', token)
+      .send({ $set: { 'meta.owner': user._id } }) // try change owner to another user
+      .expect(200)
+
+    const res2 = await request(app)
+      .get(`/users/${newUser._id}`)
+      .set('x-access-token', token)
+    expect(res2.body.meta.owner).to.equal(user._id)
+  })
+
+  it('changing to bogus owner fails', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'users: modify owner'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    await request(app)
+      .post(`/users/${newUser._id}/update`)
+      .set('x-access-token', token)
+      .send({ $set: { 'meta.owner': 'owner-that-doesnt-exist' } }) // try change owner to another user
+      .expect(417)
+  })
+
+  it('cannot set owner on creation by default', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'testdoc: create', 'testdoc: view own'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    const doc = {
+      title: 'Test Title',
+      meta: {
+        owner: user._id,
+        owner_collection: 'users',
+      }
+    }
+
+    const res2 = await request(app)
+      .post(`/testdoc`)
+      .set('x-access-token', token)
+      .send(doc)
+      .expect(200) // will succeed but owner will not change
+    doc._id = res2.body.id
+
+    const res3 = await request(app)
+      .get(`/testdoc/${doc._id}`)
+      .set('x-access-token', token)
+      .expect(200)
+    expect(res3.body.meta.owner).to.not.equal(user._id)
+    expect(res3.body.meta.owner).to.equal(newUser._id)
+  })
+
+  it('can set owner on creation with correct permission', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'testdoc: create', 'testdoc: view', 'testdoc: modify owner'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    const doc = {
+      title: 'Test Title',
+      meta: {
+        owner: user._id,
+        owner_collection: 'users',
+      }
+    }
+
+    const res2 = await request(app)
+      .post(`/testdoc`)
+      .set('x-access-token', token)
+      .send(doc)
+      .expect(200) // will succeed but owner will not change
+    doc._id = res2.body.id
+
+    const res3 = await request(app)
+      .get(`/testdoc/${doc._id}`)
+      .set('x-access-token', token)
+      .expect(200)
+    expect(res3.body.meta.owner).to.not.equal(newUser._id)
+    expect(res3.body.meta.owner).to.equal(user._id)
+  })
 })

package/util.js

@@ -6,6 +6,48 @@ const pg = require('pg')
 const pgPools = {}
 const dot = require('dot-object')
 const mongoQuery = require('mongo-query')
+const Ajv = require('ajv')
+const ajv = new Ajv({
+  allErrors: true,
+  strict: 'log',
+  strictSchema: 'log',
+  validateFormats: false,
+  allowUnionTypes: true,
+})
+ajv.addKeyword({
+  keyword: 'links',
+  type: 'string',
+  schemaType: 'array',
+})
+ajv.addKeyword({
+  keyword: 'media',
+  type: 'string',
+  schemaType: 'object',
+})
+ajv.addKeyword({
+  keyword: 'propertyOrder',
+  schemaType: 'number',
+})
+const formatKey = ajv.getKeyword('format')
+formatKey.type = formatKey.type.concat(['array', 'boolean', 'object'])
+
+const schemaValidators = {}
+
+exports.addSchemaValidator = function(collection, schema) {
+  schemaValidators[collection] = ajv.compile(schema)
+}
+
+exports.validateSchema = function(collection, doc) {
+  if (!schemaValidators[collection]) {
+    console.error(`missing schema validator for collection ${collection}`)
+    return true
+  }
+  const isValid = schemaValidators[collection](doc)
+  if (!isValid) {
+    throw new ApiError(400, schemaValidators[collection].errors.map((err) => `${err.instancePath} ${err.message}: ${JSON.stringify(err.params)}`).join(', '))
+  }
+  return true
+}
 
 exports.orderBy = function (data, orderby) {
   data.sort(function compare (a, b) {
@@ -160,44 +202,6 @@ exports.createSecureRandomId = function() {
   return crypto.randomBytes(24).toString('hex')
 }
 
-exports.getUserWithPermissions = async function (api, permissions) {
-  if (typeof permissions === 'string') {
-    permissions = [permissions]
-  }
-  permissions = permissions || []
-  const permissionsMap = {}
-  permissions.forEach(function (permission) {
-    permissionsMap[permission] = true
-  })
-  const randId = randomstring.generate(12)
-  const roleName = 'role' + randId
-  const now = new Date().toISOString()
-  const user = {
-    email: 'test' + randId + '@example.com',
-    password: '123',
-    collection: 'users',
-    roles: [roleName],
-    meta: {
-      created: now,
-      updated: now,
-      password_last_updated_at: now,
-    }
-  }
-  await api.db.role.cache.create({
-    _id: roleName,
-    permissions: permissionsMap
-  })
-  const result = await api.db.users.create(user)
-  user._id = result
-  const payload = api.util.doLogin({
-    id: user._id,
-    collection: 'users',
-    timestamp: user.meta.password_last_updated_at,
-    jwt_secret: api.settings.jwt_secret,
-  })
-  return payload.token
-}
-
 const severities = ['critical', 'error', 'warning', 'notice', 'info', 'debug']
 exports.getLogSeverity = function (status) {
   const severity = status >= 500 ? 'error'
@@ -339,7 +343,7 @@ exports.addIdIfMissing = function addIdIfMissing (document) {
 }
 
 exports.sortObjectKeys = function sortObjectKeys(object) {
-  if (typeof object != 'object' || object instanceof Array) { // Do not sort the array
+  if (typeof object != 'object' || object instanceof Array || !object) { // Do not sort the array
     return object
   }
   const keys = Object.keys(object)
@@ -364,10 +368,10 @@ exports.getLoginCollections = async function(api) {
 function isValidLoginCollection(collection) {
   const name = collection._id
   if(collection.enableLogin === true) {
-    const properties = collection.schema && collection.schema.properties
-    if (properties && properties.email && properties.password && properties.roles) {
-      const required = collection.schema && collection.schema.required
-      if (required && required.includes('email') && required.includes('password')) {
+    const properties = collection.schema?.properties
+    if (properties && properties.password && properties.roles) {
+      const required = collection.schema?.required
+      if (required?.includes('password')) {
         return true
       }
       else {