expressa 2.0.20 → 2.0.22

package/modules/permissions/permissions.js

@@ -1,106 +1,106 @@
-const { collectionPermissions, collectionOwnerPermissions } = require('../collections/collections')
-
-exports.settingSchema = {
-  enforce_permissions: {
-    type: 'boolean',
-    description: 'Whether permissions should be checked. Only turn off if needed for testing.',
-    default: true,
-    format: 'checkbox',
-  }
-}
-
-exports.collections = [{
-  _id: 'role',
-  schema: {
-    type: 'object',
-    additionalProperties: false,
-    properties: {
-      _id: {
-        type: 'string'
-      },
-      permissions: {
-        type: 'object',
-        additionalProperties: true,
-        properties: {},
-        description: 'list of permissions this role has'
-      }
-    },
-    required: [
-      '_id',
-      'permissions'
-    ]
-  },
-  cacheInMemory: true,
-  documentsHaveOwners: false
-}]
-
-exports.install = async function (app) {
-  app.db.role.create({
-    _id: 'Admin',
-    permissions: {}
-  })
-
-  app.db.role.create({
-    _id: 'Authenticated',
-    permissions: {
-      'users: view own': 1,
-      'users: edit own': 1,
-      'users: delete own': 1,
-    }
-  })
-
-  app.db.role.create({
-    _id: 'Anonymous',
-    permissions: {
-      'users: create': 1
-    }
-  })
-}
-
-exports.permissions = ['users: modify roles', 'login to admin']
-
-exports.init = async function (api) {
-  api.addCollectionListener(['changed'], 'collection', async function addCollectionPerms (req, collection, data) {
-    if (api.db.role) {
-      try {
-        const admin = await api.db.role.get('Admin')
-        collectionPermissions(data._id).forEach(function (permission) {
-          if (admin.permissions[permission] == null) {
-            admin.permissions[permission] = 1
-          }
-        })
-        collectionOwnerPermissions(data._id).forEach(function (permission) {
-          if (data.documentsHaveOwners) {
-            if (admin.permissions[permission] == null) {
-              admin.permissions[permission] = 1
-            }
-          }
-          else {
-            delete admin.permissions[permission]
-          }
-        })
-        await api.db.role.update('Admin', admin)
-      } catch (e) {
-        // This error is expected if install is not complete
-        if (api.installed || e.message !== 'document not found') {
-          console.error('Error updating admin role with permissions')
-          console.error(e)
-          console.error(e.message)
-        }
-      }
-    }
-  })
-
-  api.addCollectionListener('delete', 'collection', async function removeCollectionPerms (req, collection, data) {
-    if (api.db.role) {
-      const coll = data._id
-      const admin = await api.db.role.get('Admin')
-      const permissions = collectionPermissions(coll).concat(collectionOwnerPermissions(coll))
-      permissions.forEach((permission) => {
-        delete admin.permissions[permission]
-      })
-      await api.db.role.update('Admin', admin)
-    }
-  })
-
-}
+const { collectionPermissions, collectionOwnerPermissions } = require('../collections/collections')
+
+exports.settingSchema = {
+  enforce_permissions: {
+    type: 'boolean',
+    description: 'Whether permissions should be checked. Only turn off if needed for testing.',
+    default: true,
+    format: 'checkbox',
+  }
+}
+
+exports.collections = [{
+  _id: 'role',
+  schema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+      _id: {
+        type: 'string'
+      },
+      permissions: {
+        type: 'object',
+        additionalProperties: true,
+        properties: {},
+        description: 'list of permissions this role has'
+      }
+    },
+    required: [
+      '_id',
+      'permissions'
+    ]
+  },
+  cacheInMemory: true,
+  documentsHaveOwners: false
+}]
+
+exports.install = async function (app) {
+  app.db.role.create({
+    _id: 'Admin',
+    permissions: {}
+  })
+
+  app.db.role.create({
+    _id: 'Authenticated',
+    permissions: {
+      'users: view own': 1,
+      'users: edit own': 1,
+      'users: delete own': 1,
+    }
+  })
+
+  app.db.role.create({
+    _id: 'Anonymous',
+    permissions: {
+      'users: create': 1
+    }
+  })
+}
+
+exports.permissions = ['users: modify roles', 'login to admin']
+
+exports.init = async function (api) {
+  api.addCollectionListener(['changed'], 'collection', async function addCollectionPerms (req, collection, data) {
+    if (api.db.role) {
+      try {
+        const admin = await api.db.role.get('Admin')
+        collectionPermissions(data._id).forEach(function (permission) {
+          if (admin.permissions[permission] == null) {
+            admin.permissions[permission] = 1
+          }
+        })
+        collectionOwnerPermissions(data._id).forEach(function (permission) {
+          if (data.documentsHaveOwners) {
+            if (admin.permissions[permission] == null) {
+              admin.permissions[permission] = 1
+            }
+          }
+          else {
+            delete admin.permissions[permission]
+          }
+        })
+        await api.db.role.update('Admin', admin)
+      } catch (e) {
+        // This error is expected if install is not complete
+        if (api.installed || e.message !== 'document not found') {
+          console.error('Error updating admin role with permissions')
+          console.error(e)
+          console.error(e.message)
+        }
+      }
+    }
+  })
+
+  api.addCollectionListener('delete', 'collection', async function removeCollectionPerms (req, collection, data) {
+    if (api.db.role) {
+      const coll = data._id
+      const admin = await api.db.role.get('Admin')
+      const permissions = collectionPermissions(coll).concat(collectionOwnerPermissions(coll))
+      permissions.forEach((permission) => {
+        delete admin.permissions[permission]
+      })
+      await api.db.role.update('Admin', admin)
+    }
+  })
+
+}

package/package.json

@@ -1,59 +1,59 @@
-{
-  "name": "expressa",
-  "version": "2.0.20",
-  "description": "API framework using JSON schemas",
-  "main": "index.js",
-  "repository": "https://github.com/thomas4019/expressa",
-  "bin": {
-    "expressa": "./scripts/expressa"
-  },
-  "dependencies": {
-    "ajv": "^8.1.0",
-    "bcryptjs": "2.4.3",
-    "body-parser": "^1.19.0",
-    "debug": "^2.6.1",
-    "dot-object": "^2.1.4",
-    "express": "^4.17.1",
-    "jfs": "^0.2.6",
-    "jsonwebtoken": "^9.0.0",
-    "mongo-query": "^0.5.7",
-    "mongo-query-to-postgres-jsonb": "^0.2.17",
-    "mongo-querystring": "4.1.1",
-    "mongodb": "^3.5.7",
-    "on-finished": "^2.3.0",
-    "pg": "^8.4.2",
-    "randomstring": "1.1.4",
-    "sift": "^5.1.0",
-    "uuid": "^8.3.0"
-  },
-  "devDependencies": {
-    "chai": "^4.2.0",
-    "cross-env": "^7.0.2",
-    "cypress": "^15.3.0",
-    "eslint": "^7.1.0",
-    "mocha": "^11.7.2",
-    "mocha-junit-reporter": "^2.0.2",
-    "nodemon": "^3.1.10",
-    "rimraf": "^3.0.2",
-    "supertest": "^3.4.2"
-  },
-  "engines": {
-    "node": ">= 8.1.4"
-  },
-  "author": "Thomas Hansen <th4019@example.com> (http://thomashansen.me)",
-  "scripts": {
-    "test": "cross-env NODE_ENV=local_test_suite mocha --exit",
-    "testlint": "cross-env NODE_ENV=local_test_suite mocha --exit && npm run lint",
-    "testdebug": "cross-env NODE_ENV=local_test_suite DEBUG=expressa mocha -b --exit && npm run lint",
-    "ci-test": "cross-env NODE_ENV=local_test_suite mocha test --reporter mocha-junit-reporter --exit",
-    "clean": "rimraf node_modules",
-    "lint": "eslint .",
-    "fixlint": "eslint . --fix",
-    "testserver": "rimraf testdata && node test/testserver.js",
-    "testserver-watch": "rimraf testdata && nodemon test/testserver.js",
-    "cypress": "cypress open",
-    "testdbs": "./scripts/run_db_tests.sh",
-    "testcypress": "./scripts/run_cypress_tests.sh"
-  },
-  "license": "MIT"
-}
+{
+  "name": "expressa",
+  "version": "2.0.22",
+  "description": "API framework using JSON schemas",
+  "main": "index.js",
+  "repository": "https://github.com/thomas4019/expressa",
+  "bin": {
+    "expressa": "./scripts/expressa"
+  },
+  "dependencies": {
+    "ajv": "^8.1.0",
+    "bcryptjs": "2.4.3",
+    "body-parser": "^1.19.0",
+    "debug": "^2.6.1",
+    "dot-object": "^2.1.4",
+    "express": "^4.17.1",
+    "jfs": "^0.2.6",
+    "jsonwebtoken": "^9.0.0",
+    "mongo-query": "^0.5.7",
+    "mongo-query-to-postgres-jsonb": "^0.2.17",
+    "mongo-querystring": "4.1.1",
+    "mongodb": "^3.5.7",
+    "on-finished": "^2.3.0",
+    "pg": "^8.4.2",
+    "randomstring": "1.1.4",
+    "sift": "^5.1.0",
+    "uuid": "^8.3.0"
+  },
+  "devDependencies": {
+    "chai": "^4.2.0",
+    "cross-env": "^7.0.2",
+    "cypress": "^15.3.0",
+    "eslint": "^7.1.0",
+    "mocha": "^11.7.2",
+    "mocha-junit-reporter": "^2.0.2",
+    "nodemon": "^3.1.10",
+    "rimraf": "^3.0.2",
+    "supertest": "^3.4.2"
+  },
+  "engines": {
+    "node": ">= 8.1.4"
+  },
+  "author": "Thomas Hansen <th4019@example.com> (http://thomashansen.me)",
+  "scripts": {
+    "test": "cross-env NODE_ENV=local_test_suite mocha --exit",
+    "testlint": "cross-env NODE_ENV=local_test_suite mocha --exit && npm run lint",
+    "testdebug": "cross-env NODE_ENV=local_test_suite DEBUG=expressa mocha -b --exit && npm run lint",
+    "ci-test": "cross-env NODE_ENV=local_test_suite mocha test --reporter mocha-junit-reporter --exit",
+    "clean": "rimraf node_modules",
+    "lint": "eslint .",
+    "fixlint": "eslint . --fix",
+    "testserver": "rimraf testdata && node test/testserver.js",
+    "testserver-watch": "rimraf testdata && nodemon test/testserver.js",
+    "cypress": "cypress open",
+    "testdbs": "./scripts/run_db_tests.sh",
+    "testcypress": "./scripts/run_cypress_tests.sh"
+  },
+  "license": "MIT"
+}

package/scripts/expressa

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-
-'use strict';
-
-var express = require('express');
-var app = express();
-
-var expressa = require('../');
-app.use('/api', expressa.api());            // optionally pass in settings
-app.use('/admin', expressa.admin({ apiurl: '/api/' }));
-
-app.listen(3000, function () {
-  console.log('Example app listening on port 3000!');
+
+'use strict';
+
+var express = require('express');
+var app = express();
+
+var expressa = require('../');
+app.use('/api', expressa.api());            // optionally pass in settings
+app.use('/admin', expressa.admin({ apiurl: '/api/' }));
+
+app.listen(3000, function () {
+  console.log('Example app listening on port 3000!');
 });

package/scripts/run_cypress_tests.sh

@@ -1,36 +1,36 @@
-set -e
-
-rm -rf testdata
-
-node test/testserver.js &
-pid=$!
-
-cleanup() {
-  if kill -0 "$pid" >/dev/null 2>&1; then
-    kill "$pid" || true
-    # give it a moment to exit gracefully
-    sleep 1 || true
-    if kill -0 "$pid" >/dev/null 2>&1; then
-      kill -9 "$pid" || true
-    fi
-  fi
-}
-trap cleanup EXIT
-
-# Wait for server readiness
-attempts=0
-until curl -sSf "http://localhost:3001/admin" >/dev/null 2>&1; do
-  attempts=$((attempts+1))
-  if [ "$attempts" -gt 120 ]; then
-    echo "Server did not become ready on http://localhost:3001/admin" >&2
-    exit 1
-  fi
-  # bail out early if server died
-  if ! kill -0 "$pid" >/dev/null 2>&1; then
-    echo "Server process exited prematurely" >&2
-    exit 1
-  fi
-  sleep 0.5
-done
-
+set -e
+
+rm -rf testdata
+
+node test/testserver.js &
+pid=$!
+
+cleanup() {
+  if kill -0 "$pid" >/dev/null 2>&1; then
+    kill "$pid" || true
+    # give it a moment to exit gracefully
+    sleep 1 || true
+    if kill -0 "$pid" >/dev/null 2>&1; then
+      kill -9 "$pid" || true
+    fi
+  fi
+}
+trap cleanup EXIT
+
+# Wait for server readiness
+attempts=0
+until curl -sSf "http://localhost:3001/admin" >/dev/null 2>&1; do
+  attempts=$((attempts+1))
+  if [ "$attempts" -gt 120 ]; then
+    echo "Server did not become ready on http://localhost:3001/admin" >&2
+    exit 1
+  fi
+  # bail out early if server died
+  if ! kill -0 "$pid" >/dev/null 2>&1; then
+    echo "Server process exited prematurely" >&2
+    exit 1
+  fi
+  sleep 0.5
+done
+
 ./node_modules/.bin/cypress run

package/scripts/run_db_tests.sh

@@ -1,8 +1,8 @@
-docker run -d -p 5432:5432 --rm --name postgres -e POSTGRES_PASSWORD=expressa postgres
-docker run -d -p 27017:27017 --rm --name mongo mongo
-sleep 1
-docker exec -it postgres /bin/bash -c "createdb pgtest -U postgres"
-TEST_POSTGRES=true TEST_MONGO=true npm run test
-
-docker stop postgres
-docker stop mongo
+docker run -d -p 5432:5432 --rm --name postgres -e POSTGRES_PASSWORD=expressa postgres
+docker run -d -p 27017:27017 --rm --name mongo mongo
+sleep 1
+docker exec -it postgres /bin/bash -c "createdb pgtest -U postgres"
+TEST_POSTGRES=true TEST_MONGO=true npm run test
+
+docker stop postgres
+docker stop mongo

package/test/0-install.js

@@ -1,96 +1,96 @@
-const request = require('supertest')
-const chai = require('chai')
-const expect = chai.expect
-const testutils = require('./testutils')
-const { app, api } = testutils
-
-describe('install flow', function () {
-  it('can get settings schema', async function() {
-    const { body } = await request(app)
-      .get('/install/settings/schema')
-      .expect(200)
-    expect(body.schema.properties.jwt_secret).to.eql({
-      type: 'string',
-      description: 'The secret key used to encode your json web tokens. It\'s important this is kept unique and secret.'
-    })
-  })
-
-  it('call install', async function () {
-    expect(api.db.collections).to.not.exist
-
-    await request(app)
-      .post('/install')
-      .send({
-        modules: ['collections', 'core', 'logging', 'permissions', 'access_keys'],
-        settings: {
-          jwt_secret: 'testing 123',
-          jwt_expire_on_password_change: true,
-          mongodb_uri: 'mongodb://localhost:27017/test',
-          postgresql_uri: 'postgresql://postgres:expressa@localhost/pgtest',
-          enforce_permissions: true,
-          user_storage: 'mongo'
-        }
-      })
-      .expect(200)
-
-    expect(api.db.collection).to.exist
-    expect(api.db.role).to.exist
-    expect(api.db.users).to.exist
-    expect(api.settings.jwt_secret.length).to.be.greaterThan(20)
-
-    // Check storage of users set correctly and then restore to 'file'
-    const userCollection = (await api.db.collection.find({ _id: 'users' }))[0]
-    expect(userCollection.storage).to.eql('mongo')
-    userCollection.storage = 'file'
-    await api.db.collection.update(null, userCollection)
-    api.setupCollectionDb(userCollection)
-
-    const userCollection2 = (await api.db.collection.find({ _id: 'users' }))[0]
-    expect(userCollection2.storage).to.eql('file')
-  })
-
-  it('can create admin account', async function() {
-    const res = await request(app)
-      .post('/users/register')
-      .send({
-        email: 'a@example.com',
-        roles: ['Admin'],
-        password: '123'
-      })
-      .expect(200)
-    const id = res.body.id
-    const u = await api.db.users.get(id)
-    expect(u.roles || []).to.include('Admin')
-  })
-
-  it('can login admin account', async function() {
-    const res = await request(app)
-      .post('/users/login')
-      .send({
-        email: 'a@example.com',
-        password: '123'
-      })
-      .expect(200)
-    testutils.setAdminToken(res.body.token)
-  })
-
-  it('2nd account cannot be admin account', async function() {
-    await request(app)
-      .post('/users/register')
-      .send({
-        email: 'try2@example.com',
-        roles: ['Admin'],
-        password: 'admin2'
-      })
-      .expect(400)
-  })
-
-  it('admin should have many permissions set', async function () {
-    const admin = await api.db.role.get('Admin')
-    expect(admin.permissions).deep.include({
-      'view errors': 1,
-      'collection: create': 1,
-      'users: edit own': 1
-    })
-  })
-})
+const request = require('supertest')
+const chai = require('chai')
+const expect = chai.expect
+const testutils = require('./testutils')
+const { app, api } = testutils
+
+describe('install flow', function () {
+  it('can get settings schema', async function() {
+    const { body } = await request(app)
+      .get('/install/settings/schema')
+      .expect(200)
+    expect(body.schema.properties.jwt_secret).to.eql({
+      type: 'string',
+      description: 'The secret key used to encode your json web tokens. It\'s important this is kept unique and secret.'
+    })
+  })
+
+  it('call install', async function () {
+    expect(api.db.collections).to.not.exist
+
+    await request(app)
+      .post('/install')
+      .send({
+        modules: ['collections', 'core', 'logging', 'permissions', 'access_keys'],
+        settings: {
+          jwt_secret: 'testing 123',
+          jwt_expire_on_password_change: true,
+          mongodb_uri: 'mongodb://localhost:27017/test',
+          postgresql_uri: 'postgresql://postgres:wkDPvFPkFtlJY55n@localhost/pgtest',
+          enforce_permissions: true,
+          user_storage: 'mongo'
+        }
+      })
+      .expect(200)
+
+    expect(api.db.collection).to.exist
+    expect(api.db.role).to.exist
+    expect(api.db.users).to.exist
+    expect(api.settings.jwt_secret.length).to.be.greaterThan(20)
+
+    // Check storage of users set correctly and then restore to 'file'
+    const userCollection = (await api.db.collection.find({ _id: 'users' }))[0]
+    expect(userCollection.storage).to.eql('mongo')
+    userCollection.storage = 'file'
+    await api.db.collection.update(null, userCollection)
+    api.setupCollectionDb(userCollection)
+
+    const userCollection2 = (await api.db.collection.find({ _id: 'users' }))[0]
+    expect(userCollection2.storage).to.eql('file')
+  })
+
+  it('can create admin account', async function() {
+    const res = await request(app)
+      .post('/users/register')
+      .send({
+        email: 'a@example.com',
+        roles: ['Admin'],
+        password: '123'
+      })
+      .expect(200)
+    const id = res.body.id
+    const u = await api.db.users.get(id)
+    expect(u.roles || []).to.include('Admin')
+  })
+
+  it('can login admin account', async function() {
+    const res = await request(app)
+      .post('/users/login')
+      .send({
+        email: 'a@example.com',
+        password: '123'
+      })
+      .expect(200)
+    testutils.setAdminToken(res.body.token)
+  })
+
+  it('2nd account cannot be admin account', async function() {
+    await request(app)
+      .post('/users/register')
+      .send({
+        email: 'try2@example.com',
+        roles: ['Admin'],
+        password: 'admin2'
+      })
+      .expect(400)
+  })
+
+  it('admin should have many permissions set', async function () {
+    const admin = await api.db.role.get('Admin')
+    expect(admin.permissions).deep.include({
+      'view errors': 1,
+      'collection: create': 1,
+      'users: edit own': 1
+    })
+  })
+})