expressa 2.0.16 → 2.0.18

package/listeners.js

@@ -1,65 +1,65 @@
-const debug = require('debug')('expressa')
-const util = require('./util')
-
-module.exports = function (api) {
-  /* Listeners to avoid the need for a server restart */
-  api.addCollectionListener('changed', 'collection', async function setupCollectionStorage (req, collection, data) {
-    if (!(data.storage === 'memory' && util.getPath(api.db[data._id], 'type') === 'memory')) {
-      await api.setupCollectionDb(data)
-    }
-    debug('updated ' + data._id + ' collection storage')
-  })
-  api.addCollectionListener('delete', 'collection', function cleanupCollectionStorage (req, collection, data) {
-    delete api.db[data._id]
-    debug('removed ' + data._id + ' collection storage')
-  })
-  api.addCollectionListener('changed', 'settings', function updateInMemorySettings (req, collection, data) {
-    // TODO: only reload if current environment is updated
-    Object.assign(req.settings, data)
-  })
-
-  api.addListener(['put', 'post'], async function updateMetadata (req, collection, data, { event }) {
-    data.meta ??= {}
-    data.meta.updated = new Date().toISOString()
-    if (event === 'post') {
-      data.meta.created = new Date().toISOString()
-    }
-  })
-
-  api.addCollectionListener('get', 'schemas', function addMetaToSchema (req, collection, data) {
-    const schema = data.schema
-    if (!schema.properties.meta) {
-      schema.properties.meta = {
-        type: 'object',
-        properties: {
-          created: {
-            type: 'string'
-          },
-          updated: {
-            type: 'string'
-          }
-        }
-      }
-    }
-    if (schema.properties.meta.propertyOrder === undefined) {
-      schema.properties.meta.propertyOrder =  2000
-    }
-    if (data.documentsHaveOwners) {
-      if (!schema.properties.meta.properties.owner) {
-        schema.properties.meta.properties.owner = {
-          type: 'string',
-          links: [
-            {
-              rel: '» view owner user',
-              href: '/admin/#/edit/users/{{self}}',
-              class: 'comment-link'
-            }
-          ]
-        },
-        schema.properties.meta.properties.owner_collection = {
-          type: 'string'
-        }
-      }
-    }
-  })
-}
+const debug = require('debug')('expressa')
+const util = require('./util')
+
+module.exports = function (api) {
+  /* Listeners to avoid the need for a server restart */
+  api.addCollectionListener('changed', 'collection', async function setupCollectionStorage (req, collection, data) {
+    if (!(data.storage === 'memory' && util.getPath(api.db[data._id], 'type') === 'memory')) {
+      await api.setupCollectionDb(data)
+    }
+    debug('updated ' + data._id + ' collection storage')
+  })
+  api.addCollectionListener('delete', 'collection', function cleanupCollectionStorage (req, collection, data) {
+    delete api.db[data._id]
+    debug('removed ' + data._id + ' collection storage')
+  })
+  api.addCollectionListener('changed', 'settings', function updateInMemorySettings (req, collection, data) {
+    // TODO: only reload if current environment is updated
+    Object.assign(req.settings, data)
+  })
+
+  api.addListener(['put', 'post'], async function updateMetadata (req, collection, data, { event }) {
+    data.meta ??= {}
+    data.meta.updated = new Date().toISOString()
+    if (event === 'post') {
+      data.meta.created = new Date().toISOString()
+    }
+  })
+
+  api.addCollectionListener('get', 'schemas', function addMetaToSchema (req, collection, data) {
+    const schema = data.schema
+    if (!schema.properties.meta) {
+      schema.properties.meta = {
+        type: 'object',
+        properties: {
+          created: {
+            type: 'string'
+          },
+          updated: {
+            type: 'string'
+          }
+        }
+      }
+    }
+    if (schema.properties.meta.propertyOrder === undefined) {
+      schema.properties.meta.propertyOrder =  2000
+    }
+    if (data.documentsHaveOwners) {
+      if (!schema.properties.meta.properties.owner) {
+        schema.properties.meta.properties.owner = {
+          type: 'string',
+          links: [
+            {
+              rel: '» view owner user',
+              href: '/admin/#/edit/users/{{self}}',
+              class: 'comment-link'
+            }
+          ]
+        },
+        schema.properties.meta.properties.owner_collection = {
+          type: 'string'
+        }
+      }
+    }
+  })
+}

package/listeners_collection_permissions.js

@@ -1,29 +1,29 @@
-const util = require('./util')
-const debug = require('debug')('expressa')
-
-const eventToPermissionMapping = {
-  get: 'view',
-  put: 'edit',
-  post: 'create',
-  delete: 'delete'
-}
-
-module.exports = function (api) {
-  api.addCollectionListener('get', 'collection', function viewRelevantCollections (req, collection, data) {
-    if (req.hasPermission('collection: view relevant')) {
-      if (req.hasPermission(data._id + ': view') || req.hasPermission(data._id + ': view own')) {
-        return true // force allow
-      }
-    }
-  })
-
-  api.addListener(['get', 'put', 'post', 'delete'], function collectionPermissionCheck (req, collection, data, info) {
-    const permission = eventToPermissionMapping[info.event]
-    const editingOwnDoc = data.meta && data.meta.owner && data.meta.owner === req.uid
-    const editingOwn = editingOwnDoc && req.hasPermission(collection + ': ' + permission + ' own')
-    if (!editingOwn && !req.hasPermission(collection + ': ' + permission)) {
-      debug(`cancelling, missing permission "${collection}: ${permission}"`)
-      throw new util.ApiError(401, 'You do not have permission to perform this action.')
-    }
-  })
-}
+const util = require('./util')
+const debug = require('debug')('expressa')
+
+const eventToPermissionMapping = {
+  get: 'view',
+  put: 'edit',
+  post: 'create',
+  delete: 'delete'
+}
+
+module.exports = function (api) {
+  api.addCollectionListener('get', 'collection', function viewRelevantCollections (req, collection, data) {
+    if (req.hasPermission('collection: view relevant')) {
+      if (req.hasPermission(data._id + ': view') || req.hasPermission(data._id + ': view own')) {
+        return true // force allow
+      }
+    }
+  })
+
+  api.addListener(['get', 'put', 'post', 'delete'], function collectionPermissionCheck (req, collection, data, info) {
+    const permission = eventToPermissionMapping[info.event]
+    const editingOwnDoc = data.meta && data.meta.owner && data.meta.owner === req.uid
+    const editingOwn = editingOwnDoc && req.hasPermission(collection + ': ' + permission + ' own')
+    if (!editingOwn && !req.hasPermission(collection + ': ' + permission)) {
+      debug(`cancelling, missing permission "${collection}: ${permission}"`)
+      throw new util.ApiError(401, 'You do not have permission to perform this action.')
+    }
+  })
+}

package/listeners_users.js

@@ -1,96 +1,96 @@
-const auth = require('./auth')
-const util = require('./util.js')
-const debug = require('debug')('expressa')
-
-module.exports = async function(api) {
-
-  const loginCollections = (await util.getLoginCollections(api)).map((coll) => coll._id)
-
-  api.addCollectionListener(['post', 'put'], loginCollections, async function updatePassword(req, collection, data) {
-    if (req.method === 'PUT') {
-      if (!data.password) {
-        const oldData = await api.db[collection].get(data._id)
-        data.password = oldData.password // preserve password if not explicitly set
-      }
-    }
-    if (!auth.isHashed(data.password)) {
-      debug('hashing and replacing password in the user document.')
-      data.password = auth.createHash(data.password)
-      data.meta.password_last_updated_at = new Date().toISOString()
-    }
-  })
-
-  api.addCollectionListener('post', loginCollections, async function roleCreateCheck(req, collection, data) {
-    if (!data.roles) {
-      data.roles = []
-    }
-    // user special case to allow first user to be admin
-    if (collection === 'users') {
-      const hasUsers = (await api.db.users.find({}, 0, 1)).length === 1
-      if (!hasUsers && !data.roles.includes('Admin')) {
-        throw new util.ApiError(400, 'first user must have role Admin')
-      }
-      if (hasUsers && data.roles.length > 0 && !req.hasPermission('users: modify roles')) {
-        throw new util.ApiError(400, 'insufficient permissions to create user with roles')
-      }
-    }
-    else {
-      if (data.roles.length > 0 && !req.hasPermission(`${collection}: modify roles`)) {
-        throw new util.ApiError(400, `insufficient permissions to create ${collection} with roles`)
-      }
-    }
-  })
-
-  api.addLateCollectionListener('put', loginCollections, async function roleChangeCheck(req, collection, data) {
-    if (!req.hasPermission(`${collection}: modify roles`)) {
-      const oldData = await api.db[collection].get(data._id)
-      data.roles = oldData.roles
-    }
-  })
-
-  api.addCollectionListenerWithPriority(['get', 'changed', 'deleted'], loginCollections, 100, function hidePasswordHashes(req, collection, data) {
-    if (!req.hasPermission(`${collection}: view hashed passwords`)) {
-      debug(`deleting password because "${collection}: view hashed passwords"-permission is not set`)
-      delete data.password
-    }
-  })
-
-  api.addCollectionListener(['post', 'put'], loginCollections, async function userEmailLowerCase(req, collection, data) {
-    if (data.email) {
-      data.email = data.email.toLowerCase()
-    }
-  })
-
-  api.addCollectionListener('post', loginCollections, async function userUniquenessCheck(req, collection, data) {
-    if (data.email) {
-      const result = await api.db[collection].find({email: data.email})
-      if (result.length > 0) {
-        throw new util.ApiError(409, 'This email is already registered.')
-      }
-    }
-  })
-
-  /* Mantain users-roles reference */
-  api.addCollectionListener('changed', 'role', async function addRoleToUserSchema(req, collection, data) {
-    for (const coll of loginCollections) {
-      const doc = await api.db.collection.get(coll)
-      if (!doc.schema.properties.roles.items.enum.includes(data._id)) {
-        doc.schema.properties.roles.items.enum.push(data._id)
-        await api.db.collection.update(coll, doc)
-        await api.notify('changed', req, 'collection', doc)
-      }
-    }
-  })
-
-  api.addCollectionListener('deleted', 'role', async function removeRoleToUserSchema(req, collection, data) {
-    for (const coll of loginCollections) {
-      const doc = await api.db.collection.get(coll)
-      const roles = doc.schema.properties.roles.items.enum
-      if (roles.includes(data._id)) {
-        roles.splice(roles.indexOf(data._id), 1)
-        await api.db.collection.update(coll, doc)
-        await api.notify('changed', req, 'collection', doc)
-      }
-    }
-  })
-}
+const auth = require('./auth')
+const util = require('./util.js')
+const debug = require('debug')('expressa')
+
+module.exports = async function(api) {
+
+  const loginCollections = (await util.getLoginCollections(api)).map((coll) => coll._id)
+
+  api.addCollectionListener(['post', 'put'], loginCollections, async function updatePassword(req, collection, data) {
+    if (req.method === 'PUT') {
+      if (!data.password) {
+        const oldData = await api.db[collection].get(data._id)
+        data.password = oldData.password // preserve password if not explicitly set
+      }
+    }
+    if (!auth.isHashed(data.password)) {
+      debug('hashing and replacing password in the user document.')
+      data.password = auth.createHash(data.password)
+      data.meta.password_last_updated_at = new Date().toISOString()
+    }
+  })
+
+  api.addCollectionListener('post', loginCollections, async function roleCreateCheck(req, collection, data) {
+    if (!data.roles) {
+      data.roles = []
+    }
+    // user special case to allow first user to be admin
+    if (collection === 'users') {
+      const hasUsers = (await api.db.users.find({}, 0, 1)).length === 1
+      if (!hasUsers && !data.roles.includes('Admin')) {
+        throw new util.ApiError(400, 'first user must have role Admin')
+      }
+      if (hasUsers && data.roles.length > 0 && !req.hasPermission('users: modify roles')) {
+        throw new util.ApiError(400, 'insufficient permissions to create user with roles')
+      }
+    }
+    else {
+      if (data.roles.length > 0 && !req.hasPermission(`${collection}: modify roles`)) {
+        throw new util.ApiError(400, `insufficient permissions to create ${collection} with roles`)
+      }
+    }
+  })
+
+  api.addLateCollectionListener('put', loginCollections, async function roleChangeCheck(req, collection, data) {
+    if (!req.hasPermission(`${collection}: modify roles`)) {
+      const oldData = await api.db[collection].get(data._id)
+      data.roles = oldData.roles
+    }
+  })
+
+  api.addCollectionListenerWithPriority(['get', 'changed', 'deleted'], loginCollections, 100, function hidePasswordHashes(req, collection, data) {
+    if (!req.hasPermission(`${collection}: view hashed passwords`)) {
+      debug(`deleting password because "${collection}: view hashed passwords"-permission is not set`)
+      delete data.password
+    }
+  })
+
+  api.addCollectionListener(['post', 'put'], loginCollections, async function userEmailLowerCase(req, collection, data) {
+    if (data.email) {
+      data.email = data.email.toLowerCase()
+    }
+  })
+
+  api.addCollectionListener('post', loginCollections, async function userUniquenessCheck(req, collection, data) {
+    if (data.email) {
+      const result = await api.db[collection].find({email: data.email})
+      if (result.length > 0) {
+        throw new util.ApiError(409, 'This email is already registered.')
+      }
+    }
+  })
+
+  /* Mantain users-roles reference */
+  api.addCollectionListener('changed', 'role', async function addRoleToUserSchema(req, collection, data) {
+    for (const coll of loginCollections) {
+      const doc = await api.db.collection.get(coll)
+      if (!doc.schema.properties.roles.items.enum.includes(data._id)) {
+        doc.schema.properties.roles.items.enum.push(data._id)
+        await api.db.collection.update(coll, doc)
+        await api.notify('changed', req, 'collection', doc)
+      }
+    }
+  })
+
+  api.addCollectionListener('deleted', 'role', async function removeRoleToUserSchema(req, collection, data) {
+    for (const coll of loginCollections) {
+      const doc = await api.db.collection.get(coll)
+      const roles = doc.schema.properties.roles.items.enum
+      if (roles.includes(data._id)) {
+        roles.splice(roles.indexOf(data._id), 1)
+        await api.db.collection.update(coll, doc)
+        await api.notify('changed', req, 'collection', doc)
+      }
+    }
+  })
+}

package/listeners_validation.js

@@ -1,43 +1,43 @@
-const util = require('./util')
-
-function addImplicitFields (schema) {
-  schema['properties'] ??= {}
-  schema['properties']['meta'] ??= { type: 'object' }
-  schema['properties']['meta']['properties'] ??= {}
-  schema['properties']['meta']['properties']['created'] ??= { type: 'string' }
-  schema['properties']['meta']['properties']['updated'] ??= { type: 'string' }
-  schema['properties']['meta']['properties']['owner'] ??= { type: 'string' }
-  schema['properties']['meta']['properties']['owner_collection'] ??= { type: 'string' }
-  schema['properties']['_id'] ??= { type: 'string' }
-  return schema
-}
-
-module.exports = async function (api) {
-
-  // Load all validators
-  const collections = await api.db.collection.all()
-  collections.forEach((collection) => {
-    const schema = addImplicitFields(collection.schema)
-    util.addSchema(collection._id, schema)
-  })
-
-  // Load new and update validators as necessary
-  api.addCollectionListener('changed', 'collection', function updateSchemaValidators (req, collection, data) {
-    const schema = addImplicitFields(data.schema)
-    util.addSchema(data._id, schema)
-  })
-
-  api.addCollectionListener('get', ['collection', 'schemas'], function ensureIdAdded (req, collection, data) {
-    if (data.schema) {
-      data.schema = addImplicitFields(data.schema)
-    }
-  })
-
-  api.addListener(['put', 'post'], function matchesSchema (req, collection, data) {
-    // TODO (switch to check if "installed" after install tests are done.
-    if (!req.settings.enforce_permissions) {
-      return
-    }
-    util.validateSchema(collection, data)
-  })
-}
+const util = require('./util')
+
+function addImplicitFields (schema) {
+  schema['properties'] ??= {}
+  schema['properties']['meta'] ??= { type: 'object' }
+  schema['properties']['meta']['properties'] ??= {}
+  schema['properties']['meta']['properties']['created'] ??= { type: 'string' }
+  schema['properties']['meta']['properties']['updated'] ??= { type: 'string' }
+  schema['properties']['meta']['properties']['owner'] ??= { type: 'string' }
+  schema['properties']['meta']['properties']['owner_collection'] ??= { type: 'string' }
+  schema['properties']['_id'] ??= { type: 'string' }
+  return schema
+}
+
+module.exports = async function (api) {
+
+  // Load all validators
+  const collections = await api.db.collection.all()
+  collections.forEach((collection) => {
+    const schema = addImplicitFields(collection.schema)
+    util.addSchema(collection._id, schema)
+  })
+
+  // Load new and update validators as necessary
+  api.addCollectionListener('changed', 'collection', function updateSchemaValidators (req, collection, data) {
+    const schema = addImplicitFields(data.schema)
+    util.addSchema(data._id, schema)
+  })
+
+  api.addCollectionListener('get', ['collection', 'schemas'], function ensureIdAdded (req, collection, data) {
+    if (data.schema) {
+      data.schema = addImplicitFields(data.schema)
+    }
+  })
+
+  api.addListener(['put', 'post'], function matchesSchema (req, collection, data) {
+    // TODO (switch to check if "installed" after install tests are done.
+    if (!req.settings.enforce_permissions) {
+      return
+    }
+    util.validateSchema(collection, data)
+  })
+}

package/middleware/logging.js

@@ -1,30 +1,30 @@
-const onFinished = require('on-finished')
-
-const util = require('../util')
-
-module.exports = function logRequests(req, res, next) {
-  if (req.db.requestlog) {
-    const oldSend = res.send
-    res.send = function(...params) {
-      const data = params[0]
-      // ensure requests using custom middleware log error messages
-      if (typeof data?.error === 'string') {
-        req.returnedError ??= new util.ApiError(res.statusCode, data.error)
-      }
-      res.send = oldSend // set function back to avoid the 'double-send'
-      return res.send(...params) // just call as normal with data
-    }
-    onFinished(res, async function (err) {
-      if (err) {
-        console.error('error found while logging.')
-        console.error(err)
-        return
-      }
-      if (util.shouldLogRequest(req, res)) {
-        const entry = util.createLogEntry(req, res)
-        await req.db.requestlog.create(entry)
-      }
-    })
-  }
-  next()
-}
+const onFinished = require('on-finished')
+
+const util = require('../util')
+
+module.exports = function logRequests(req, res, next) {
+  if (req.db.requestlog) {
+    const oldSend = res.send
+    res.send = function(...params) {
+      const data = params[0]
+      // ensure requests using custom middleware log error messages
+      if (typeof data?.error === 'string') {
+        req.returnedError ??= new util.ApiError(res.statusCode, data.error)
+      }
+      res.send = oldSend // set function back to avoid the 'double-send'
+      return res.send(...params) // just call as normal with data
+    }
+    onFinished(res, async function (err) {
+      if (err) {
+        console.error('error found while logging.')
+        console.error(err)
+        return
+      }
+      if (util.shouldLogRequest(req, res)) {
+        const entry = util.createLogEntry(req, res)
+        await req.db.requestlog.create(entry)
+      }
+    })
+  }
+  next()
+}

package/middleware/permissions.js

@@ -1,41 +1,41 @@
-const util = require('../util')
-let authenticatedRoleExists
-
-async function addRolePermissions (req, roles) {
-  const rolePermissions = await util.getEffectivePermissionsForRoles(roles, req.db)
-  req.permissions ??= {}
-  req.permissions = { ...req.permissions, ...rolePermissions }
-}
-
-async function doesAuthenticatedRoleExist(req) {
-  if (typeof authenticatedRoleExists === 'undefined') {
-    try {
-      await req.db.role.get('Authenticated')
-      authenticatedRoleExists = true
-    } catch (e) {
-      authenticatedRoleExists = false
-    }
-  }
-  return authenticatedRoleExists
-}
-
-module.exports.addRolePermissionsAsync = async function addRolePermissionsMiddlewareAsync(req) {
-  if (!req.settings || !req.settings.enforce_permissions) {
-    // Use a dummy permission getter
-    req.hasPermission = () => true
-    return
-  }
-  req.hasPermission = (permission) => util.hasPermission(req.permissions, permission)
-  let roles = ['Anonymous']
-  const isAuthenticatedRole = await doesAuthenticatedRoleExist(req)
-  if (req.uid) {
-    roles = (req.user.roles || []).concat(isAuthenticatedRole ? ['Authenticated'] : [])
-  } else {
-    req.user = {}
-  }
-  await addRolePermissions(req, roles)
-}
-
-module.exports.middleware = function addRolePermissionsMiddleware (req, res, next) {
-  module.exports.addRolePermissionsAsync(req).then(next).catch(next)
-}
+const util = require('../util')
+let authenticatedRoleExists
+
+async function addRolePermissions (req, roles) {
+  const rolePermissions = await util.getEffectivePermissionsForRoles(roles, req.db)
+  req.permissions ??= {}
+  req.permissions = { ...req.permissions, ...rolePermissions }
+}
+
+async function doesAuthenticatedRoleExist(req) {
+  if (typeof authenticatedRoleExists === 'undefined') {
+    try {
+      await req.db.role.get('Authenticated')
+      authenticatedRoleExists = true
+    } catch (e) {
+      authenticatedRoleExists = false
+    }
+  }
+  return authenticatedRoleExists
+}
+
+module.exports.addRolePermissionsAsync = async function addRolePermissionsMiddlewareAsync(req) {
+  if (!req.settings || !req.settings.enforce_permissions) {
+    // Use a dummy permission getter
+    req.hasPermission = () => true
+    return
+  }
+  req.hasPermission = (permission) => util.hasPermission(req.permissions, permission)
+  let roles = ['Anonymous']
+  const isAuthenticatedRole = await doesAuthenticatedRoleExist(req)
+  if (req.uid) {
+    roles = (req.user.roles || []).concat(isAuthenticatedRole ? ['Authenticated'] : [])
+  } else {
+    req.user = {}
+  }
+  await addRolePermissions(req, roles)
+}
+
+module.exports.middleware = function addRolePermissionsMiddleware (req, res, next) {
+  module.exports.addRolePermissionsAsync(req).then(next).catch(next)
+}