expressa 1.4.7 → 2.0.1

package/.eslintrc.json

@@ -20,7 +20,7 @@
         "xdescribe": true
     },
     "parserOptions": {
-        "ecmaVersion": 2018
+        "ecmaVersion": 2022
     },
     "env": {
         "es6": true,

package/controllers/collections.js

@@ -10,6 +10,55 @@ function assertValidCollection(req) {
   }
 }
 
+async function validateDocumentOwner(req, doc) {
+  if (!doc.meta.owner_collection) {
+    throw new util.ApiError(417, 'no owner_collection for owner found')
+  }
+  if (doc._id !== doc.meta.owner) {
+    const count = await req.db[doc.meta.owner_collection].count({ _id: doc.meta.owner }, undefined, 1)
+    if (!count) {
+      throw new util.ApiError(417, 'invalid owner')
+    }
+  } else if (req.params.collection !== doc.meta.owner_collection) {
+    throw new util.ApiError(417, 'invalid owner collection')
+  }
+}
+
+async function setDocumentOwner(req, doc) {
+  const schema = await req.db.collection.get(req.params.collection)
+  if (schema.documentsHaveOwners) {
+    util.addIdIfMissing(doc)
+    doc.meta ??= {}
+    if (req.uid) {
+      // request done by logged in user
+      if (!doc.meta.owner) {
+        // no owner - make logged in user as owner
+        doc.meta.owner = req.user._id
+        doc.meta.owner_collection = req.ucollection
+      } else {
+        if (!req.hasPermission(`${req.params.collection}: modify owner`)) {
+          // has an owner - but if no permission to modify owner then override owner to logged in user
+          doc.meta.owner = req.user._id
+          doc.meta.owner_collection = req.ucollection
+        }
+      }
+    } else {
+      // request done by NOT logged in user
+      if (schema.enableLogin) {
+        // is a user/login collection so make self owner
+        doc.meta.owner = doc._id
+        doc.meta.owner_collection = req.params.collection
+      } else {
+        // is a normal collection
+        debug('unable to find valid owner')
+      }
+    }
+    if (doc.meta.owner) {
+      await validateDocumentOwner(req, doc)
+    }
+  }
+}
+
 exports.getSchema = async function (req) {
   const collection = await req.db.collection.get(req.params.collection)
   await util.notify('get', req, 'schemas', collection)
@@ -29,7 +78,8 @@ exports.get = async function (req) {
     query = JSON.parse(req.query.query)
   }
   else {
-    const { skip, offset, limit, page, pageitems, pagemetadisable, orderby, fields, ...params } = req.query // eslint-disable-line no-unused-vars
+    const { skip, offset, limit, page, pageitems, pagemetadisable, orderby, ...params } = req.query // eslint-disable-line no-unused-vars
+    delete params.fields
     query = queryStringParser.parse(params)
   }
   if (req.query.orderby) {
@@ -41,7 +91,8 @@ exports.get = async function (req) {
     // scenario where logged in user can only retrieve own docs
     if (!req.hasPermission(`${req.params.collection}: view`) && req.hasPermission(`${req.params.collection}: view own`)) {
       query['meta.owner'] = req.uid
-      fields['meta.owner'] = 1
+      // if fields is null then all fields are requested
+      if (fields) fields['meta.owner'] = 1
     }
   }
 
@@ -94,7 +145,7 @@ exports.insert = async function (req) {
   const data = req.body
   req.customResponseData = req.customResponseData || {}
   await util.notify('post', req, req.params.collection, data)
-
+  await setDocumentOwner(req, data)
   const id = await req.db[req.params.collection].create(data)
   await util.notify('changed', req, req.params.collection, data)
   return {
@@ -145,16 +196,23 @@ exports.updateById = async function (req) {
 
   const doc = await req.db[req.params.collection].get(req.params.id)
   const owner = doc.meta && doc.meta.owner
+  const ownerCollection = doc.meta && doc.meta.owner_collection
   util.mongoUpdate(doc, modifier)
   const newOwner = doc.meta && doc.meta.owner
-  if (owner !== newOwner) {
-    debug('attempting to change document owner.')
-    doc.meta.owner = owner
+  const newOwnerCollection = doc.meta && doc.meta.owner_collection
+  if (owner !== newOwner || ownerCollection !== newOwnerCollection) {
+    if (req.hasPermission(`${req.params.collection}: modify owner`)) {
+      if (owner) {
+        await validateDocumentOwner(req, doc)
+      }
+    } else {
+      debug('attempting to change document owner.')
+      doc.meta.owner = owner
+      doc.meta.owner_collection = ownerCollection
+    }
   }
   req.body = doc
   await util.notify('put', req, req.params.collection, doc)
-
-  req.body.meta.owner = newOwner
   await req.db[req.params.collection].update(req.params.id, req.body)
   await util.notify('changed', req, req.params.collection, req.body)
   if (Object.keys(req.customResponseData)) {

package/listeners.js

@@ -18,19 +18,11 @@ module.exports = function (api) {
     Object.assign(req.settings, data)
   })
 
-  api.addListener(['put', 'post'], function updateMetadata (req, collection, data, { event }) {
-    data.meta = data.meta || {}
+  api.addListener(['put', 'post'], async function updateMetadata (req, collection, data, { event }) {
+    data.meta ??= {}
     data.meta.updated = new Date().toISOString()
     if (event === 'post') {
       data.meta.created = new Date().toISOString()
-      if (req.user) {
-        if (req.hasPermission('login to admin')) {
-          data.meta.owner = data.meta.owner || req.user._id
-        }
-        else {
-          data.meta.owner = req.user._id
-        }
-      }
     }
   })
 
@@ -63,6 +55,9 @@ module.exports = function (api) {
               class: 'comment-link'
             }
           ]
+        },
+        schema.properties.meta.properties.owner_collection = {
+          type: 'string'
         }
       }
     }

package/listeners_collection_permissions.js

@@ -19,11 +19,8 @@ module.exports = function (api) {
 
   api.addListener(['get', 'put', 'post', 'delete'], function collectionPermissionCheck (req, collection, data, info) {
     const permission = eventToPermissionMapping[info.event]
-    const editingSelf = collection === req.ucollection && data._id === req.uid
     const editingOwnDoc = data.meta && data.meta.owner && data.meta.owner === req.uid
-    const editingOwn = ((editingSelf || editingOwnDoc) &&
-      req.hasPermission(collection + ': ' + permission + ' own'))
-    // console.log(editingOwn + ' ' + editingSelf + ' ' + editingOwnDoc);
+    const editingOwn = editingOwnDoc && req.hasPermission(collection + ': ' + permission + ' own')
     if (!editingOwn && !req.hasPermission(collection + ': ' + permission)) {
       debug(`cancelling, missing permission "${collection}: ${permission}"`)
       throw new util.ApiError(401, 'You do not have permission to perform this action.')

package/listeners_users.js

@@ -1,92 +1,92 @@
-const auth = require('./auth')
-const util = require('./util.js')
-const debug = require('debug')('expressa')
-
-module.exports = async function(api) {
-
-  const loginCollections = (await util.getLoginCollections(api)).map((coll) => coll._id)
-
-  api.addCollectionListener(['post', 'put'], loginCollections, async function updatePassword(req, collection, data) {
-    if (req.method === 'PUT') {
-      if (!data.password) {
-        const oldData = await api.db[collection].get(data._id)
-        data.password = oldData.password // preserve password if not explicitly set
-      }
-    }
-    if (data.password && data.password.length !== 60 && data.password[0] !== '$') {
-      debug('hashing and replacing password in the user document.')
-      data.password = auth.createHash(data.password)
-      data.meta.password_last_updated_at = new Date().toISOString()
-    }
-  })
-
-  api.addCollectionListener('post', loginCollections, async function roleCreateCheck(req, collection, data) {
-    if (!data.roles) {
-      data.roles = []
-    }
-    // user special case to allow first user to be admin
-    if (collection === 'users') {
-      const hasUsers = (await api.db.users.find({}, 0, 1)).length === 1
-      if (!hasUsers && !data.roles.includes('Admin')) {
-        throw new util.ApiError(400, 'first user must have role Admin')
-      }
-      if (hasUsers && data.roles.length > 0 && !req.hasPermission('users: modify roles')) {
-        throw new util.ApiError(400, 'insufficient permissions to create user with roles')
-      }
-    }
-    else {
-      if (data.roles.length > 0 && !req.hasPermission(`${collection}: modify roles`)) {
-        throw new util.ApiError(400, `insufficient permissions to create ${collection} with roles`)
-      }
-    }
-  })
-
-  api.addLateCollectionListener('put', loginCollections, async function roleChangeCheck(req, collection, data) {
-    if (!req.hasPermission(`${collection}: modify roles`)) {
-      const oldData = await api.db[collection].get(data._id)
-      data.roles = oldData.roles
-    }
-  })
-
-  api.addCollectionListenerWithPriority(['get', 'changed', 'deleted'], loginCollections, 100, function hidePasswordHashes(req, collection, data) {
-    if (!req.hasPermission(`${collection}: view hashed passwords`)) {
-      debug(`deleting password because "${collection}: view hashed passwords"-permission is not set`)
-      delete data.password
-    }
-  })
-
-  api.addCollectionListener(['post', 'put'], loginCollections, async function userEmailLowerCase(req, collection, data) {
-    data.email = data.email.toLowerCase()
-  })
-
-  api.addCollectionListener('post', loginCollections, async function userUniquenessCheck(req, collection, data) {
-    const result = await api.db[collection].find({email: data.email})
-    if (result.length > 0) {
-      throw new util.ApiError(409, 'This email is already registered.')
-    }
-  })
-
-  /* Mantain users-roles reference */
-  api.addCollectionListener('changed', 'role', async function addRoleToUserSchema(req, collection, data) {
-    for (const coll of loginCollections) {
-      const doc = await api.db.collection.get(coll)
-      if (!doc.schema.properties.roles.items.enum.includes(data._id)) {
-        doc.schema.properties.roles.items.enum.push(data._id)
-        await api.db.collection.update(coll, doc)
-        await api.notify('changed', req, coll, doc)
-      }
-    }
-  })
-
-  api.addCollectionListener('deleted', 'role', async function removeRoleToUserSchema(req, collection, data) {
-    for (const coll of loginCollections) {
-      const doc = await api.db.collection.get(coll)
-      const roles = doc.schema.properties.roles.items.enum
-      if (roles.includes(data._id)) {
-        roles.splice(roles.indexOf(data._id), 1)
-        await api.db.collection.update(coll, doc)
-        await api.notify('changed', req, coll, doc)
-      }
-    }
-  })
-}
+const auth = require('./auth')
+const util = require('./util.js')
+const debug = require('debug')('expressa')
+
+module.exports = async function(api) {
+
+  const loginCollections = (await util.getLoginCollections(api)).map((coll) => coll._id)
+
+  api.addCollectionListener(['post', 'put'], loginCollections, async function updatePassword(req, collection, data) {
+    if (req.method === 'PUT') {
+      if (!data.password) {
+        const oldData = await api.db[collection].get(data._id)
+        data.password = oldData.password // preserve password if not explicitly set
+      }
+    }
+    if (data.password && data.password.length !== 60 && data.password[0] !== '$') {
+      debug('hashing and replacing password in the user document.')
+      data.password = auth.createHash(data.password)
+      data.meta.password_last_updated_at = new Date().toISOString()
+    }
+  })
+
+  api.addCollectionListener('post', loginCollections, async function roleCreateCheck(req, collection, data) {
+    if (!data.roles) {
+      data.roles = []
+    }
+    // user special case to allow first user to be admin
+    if (collection === 'users') {
+      const hasUsers = (await api.db.users.find({}, 0, 1)).length === 1
+      if (!hasUsers && !data.roles.includes('Admin')) {
+        throw new util.ApiError(400, 'first user must have role Admin')
+      }
+      if (hasUsers && data.roles.length > 0 && !req.hasPermission('users: modify roles')) {
+        throw new util.ApiError(400, 'insufficient permissions to create user with roles')
+      }
+    }
+    else {
+      if (data.roles.length > 0 && !req.hasPermission(`${collection}: modify roles`)) {
+        throw new util.ApiError(400, `insufficient permissions to create ${collection} with roles`)
+      }
+    }
+  })
+
+  api.addLateCollectionListener('put', loginCollections, async function roleChangeCheck(req, collection, data) {
+    if (!req.hasPermission(`${collection}: modify roles`)) {
+      const oldData = await api.db[collection].get(data._id)
+      data.roles = oldData.roles
+    }
+  })
+
+  api.addCollectionListenerWithPriority(['get', 'changed', 'deleted'], loginCollections, 100, function hidePasswordHashes(req, collection, data) {
+    if (!req.hasPermission(`${collection}: view hashed passwords`)) {
+      debug(`deleting password because "${collection}: view hashed passwords"-permission is not set`)
+      delete data.password
+    }
+  })
+
+  api.addCollectionListener(['post', 'put'], loginCollections, async function userEmailLowerCase(req, collection, data) {
+    data.email = data.email.toLowerCase()
+  })
+
+  api.addCollectionListener('post', loginCollections, async function userUniquenessCheck(req, collection, data) {
+    const result = await api.db[collection].find({email: data.email})
+    if (result.length > 0) {
+      throw new util.ApiError(409, 'This email is already registered.')
+    }
+  })
+
+  /* Mantain users-roles reference */
+  api.addCollectionListener('changed', 'role', async function addRoleToUserSchema(req, collection, data) {
+    for (const coll of loginCollections) {
+      const doc = await api.db.collection.get(coll)
+      if (!doc.schema.properties.roles.items.enum.includes(data._id)) {
+        doc.schema.properties.roles.items.enum.push(data._id)
+        await api.db.collection.update(coll, doc)
+        await api.notify('changed', req, 'collection', doc)
+      }
+    }
+  })
+
+  api.addCollectionListener('deleted', 'role', async function removeRoleToUserSchema(req, collection, data) {
+    for (const coll of loginCollections) {
+      const doc = await api.db.collection.get(coll)
+      const roles = doc.schema.properties.roles.items.enum
+      if (roles.includes(data._id)) {
+        roles.splice(roles.indexOf(data._id), 1)
+        await api.db.collection.update(coll, doc)
+        await api.notify('changed', req, 'collection', doc)
+      }
+    }
+  })
+}

package/listeners_validation.js

@@ -1,45 +1,43 @@
-const util = require('./util')
-
-function addImplicitFields (schema) {
-  schema['properties'] = schema['properties'] || {}
-  schema['properties']['meta'] = schema['properties']['meta'] || { type: 'object' }
-  schema['properties']['meta']['properties'] = schema['properties']['meta']['properties'] || {}
-  schema['properties']['meta']['properties']['created'] = schema['properties']['meta']['properties']['created'] ||
-      { type: 'string' }
-  schema['properties']['meta']['properties']['updated'] = schema['properties']['meta']['properties']['updated'] ||
-      { type: 'string' }
-  schema['properties']['meta']['properties']['owner'] = schema['properties']['meta']['properties']['owner'] ||
-      { type: 'string' }
-  schema['properties']['_id'] = schema['properties']['_id'] || { type: 'string' }
-  return schema
-}
-
-module.exports = async function (api) {
-
-  // Load all validators
-  const collections = await api.db.collection.all()
-  collections.forEach((collection) => {
-    const schema = addImplicitFields(collection.schema)
-    util.addSchemaValidator(collection._id, schema)
-  })
-
-  // Load new and update validators as necessary
-  api.addCollectionListener('changed', 'collection', function updateSchemaValidators (req, collection, data) {
-    const schema = addImplicitFields(data.schema)
-    util.addSchemaValidator(data._id, schema)
-  })
-
-  api.addCollectionListener('get', ['collection', 'schemas'], function ensureIdAdded (req, collection, data) {
-    if (data.schema) {
-      data.schema = addImplicitFields(data.schema)
-    }
-  })
-
-  api.addListener(['put', 'post'], function matchesSchema (req, collection, data) {
-    // TODO (switch to check if "installed" after install tests are done.
-    if (!req.settings.enforce_permissions) {
-      return
-    }
-    util.validateSchema(collection, data)
-  })
-}
+const util = require('./util')
+
+function addImplicitFields (schema) {
+  schema['properties'] ??= {}
+  schema['properties']['meta'] ??= { type: 'object' }
+  schema['properties']['meta']['properties'] ??= {}
+  schema['properties']['meta']['properties']['created'] ??= { type: 'string' }
+  schema['properties']['meta']['properties']['updated'] ??= { type: 'string' }
+  schema['properties']['meta']['properties']['owner'] ??= { type: 'string' }
+  schema['properties']['meta']['properties']['owner_collection'] ??= { type: 'string' }
+  schema['properties']['_id'] ??= { type: 'string' }
+  return schema
+}
+
+module.exports = async function (api) {
+
+  // Load all validators
+  const collections = await api.db.collection.all()
+  collections.forEach((collection) => {
+    const schema = addImplicitFields(collection.schema)
+    util.addSchemaValidator(collection._id, schema)
+  })
+
+  // Load new and update validators as necessary
+  api.addCollectionListener('changed', 'collection', function updateSchemaValidators (req, collection, data) {
+    const schema = addImplicitFields(data.schema)
+    util.addSchemaValidator(data._id, schema)
+  })
+
+  api.addCollectionListener('get', ['collection', 'schemas'], function ensureIdAdded (req, collection, data) {
+    if (data.schema) {
+      data.schema = addImplicitFields(data.schema)
+    }
+  })
+
+  api.addListener(['put', 'post'], function matchesSchema (req, collection, data) {
+    // TODO (switch to check if "installed" after install tests are done.
+    if (!req.settings.enforce_permissions) {
+      return
+    }
+    util.validateSchema(collection, data)
+  })
+}

package/modules/collections/collections.js

@@ -1,11 +1,19 @@
 function getCollectionPermissions (name, hasOwner) {
-  let permissions = ['create', 'view', 'edit', 'delete'].map((action) => `${name}: ${action}`)
+  let permissions = exports.collectionPermissions(name)
   if (hasOwner) {
-    permissions = permissions.concat(['view', 'edit', 'delete'].map((action) => `${name}: ${action} own`))
+    permissions = permissions.concat(exports.collectionOwnerPermissions(name))
   }
   return permissions
 }
 
+exports.collectionPermissions = function (name) {
+  return ['create', 'view', 'edit', 'modify owner', 'delete'].map((action) => `${name}: ${action}`)
+}
+
+exports.collectionOwnerPermissions = function (name) {
+  return ['view', 'edit', 'delete'].map((action) => `${name}: ${action} own`)
+}
+
 exports.permissions = async function (app) {
   const collections = (await app.db.collection.all()).map((collection) => collection._id)
   // flatten the permissions into a single list

package/modules/permissions/permissions.js

@@ -1,3 +1,5 @@
+const { collectionPermissions, collectionOwnerPermissions } = require('../collections/collections')
+
 exports.settingSchema = {
   enforce_permissions: {
     type: 'boolean',
@@ -57,14 +59,6 @@ exports.install = async function (app) {
 
 exports.permissions = ['users: modify roles', 'login to admin']
 
-function collectionPermissions (name) {
-  return ['create', 'view', 'edit', 'delete'].map((action) => `${name}: ${action}`)
-}
-
-function collectionOwnerPermissions (name) {
-  return ['view', 'edit', 'delete'].map((action) => `${name}: ${action} own`)
-}
-
 exports.init = async function (api) {
   api.addCollectionListener(['changed'], 'collection', async function addCollectionPerms (req, collection, data) {
     if (api.db.role) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expressa",
-  "version": "1.4.7",
+  "version": "2.0.1",
   "description": "API framework using JSON schemas",
   "main": "index.js",
   "repository": "https://github.com/thomas4019/expressa",

package/test/0-install.js

@@ -63,6 +63,17 @@ describe('install flow', function () {
     expect(u.roles || []).to.include('Admin')
   })
 
+  it('can login admin account', async function() {
+    const res = await request(app)
+      .post('/users/login')
+      .send({
+        email: 'a@example.com',
+        password: '123'
+      })
+      .expect(200)
+    testutils.setAdminToken(res.body.token)
+  })
+
   it('2nd account cannot be admin account', async function() {
     await request(app)
       .post('/users/register')

package/test/collections.querying.js

@@ -11,7 +11,7 @@ const { app, api } = testutils
  */
 describe('querying collections', function () {
   it('create doc 1', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: create')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: create')
     await request(app)
       .post('/testdoc')
       .set('x-access-token', token)
@@ -28,7 +28,7 @@ describe('querying collections', function () {
   })
 
   it('create doc 2', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: create')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: create')
     await request(app)
       .post('/testdoc')
       .set('x-access-token', token)
@@ -42,7 +42,7 @@ describe('querying collections', function () {
   })
 
   it('create doc 3', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: create')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: create')
     await request(app)
       .post('/testdoc')
       .set('x-access-token', token)
@@ -60,7 +60,7 @@ describe('querying collections', function () {
   let token
 
   it('read doc by id', async function () {
-    token = await util.getUserWithPermissions(api, 'testdoc: view')
+    token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc/testid123')
       .set('x-access-token', token)
@@ -202,7 +202,7 @@ describe('querying collections', function () {
   })
 
   it('sort by deep field ascending', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: view')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc?orderby={"data.number":1}')
       .set('x-access-token', token)
@@ -214,7 +214,7 @@ describe('querying collections', function () {
   })
 
   it('sort by deep field descending', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: view')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc?orderby={"meta.created":-1}')
       .set('x-access-token', token)
@@ -226,7 +226,7 @@ describe('querying collections', function () {
   })
 
   it('project a specific field', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: view')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc?fields={"title":1}')
       .set('x-access-token', token)
@@ -237,7 +237,7 @@ describe('querying collections', function () {
   })
 
   it('project a specific field on get', async function () {
-    const token = await util.getUserWithPermissions(api, 'testdoc: view')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc/test1?fields={"title":1}')
       .set('x-access-token', token)
@@ -247,7 +247,7 @@ describe('querying collections', function () {
   })
 
   it('project deep fields', async function() {
-    const token = await util.getUserWithPermissions(api, 'testdoc: view')
+    const token = await testutils.getUserWithPermissions(api, 'testdoc: view')
     const res = await request(app)
       .get('/testdoc?fields={"data":1}')
       .set('x-access-token', token)
@@ -266,4 +266,4 @@ describe('querying collections', function () {
     expect(res2.body[0].data.number).to.equal(0)
     expect(res2.body[0].data.field).to.be.undefined
   })
-})
+})

package/test/test.js

@@ -70,7 +70,7 @@ describe('General Tests:', () => {
       res.send(req.user)
     })
 
-    const token = await util.getUserWithPermissions(api, [])
+    const token = await testutils.getUserWithPermissions(api, [])
     const res = await request(app)
       .get('/test')
       .set('x-access-token', token)