expressa 2.0.6 → 2.0.8

package/auth/index.js

@@ -1,47 +1,50 @@
-const bcrypt = require('bcryptjs')
-const handler = require('./jwt')
-const util = require('../util')
-
-exports.createHash = function (password) {
-  const salt = bcrypt.genSaltSync(10)
-  return bcrypt.hashSync(password, salt)
-}
-
-exports.isValidPassword = function (password, hashedPassword) {
-  return bcrypt.compareSync(password, hashedPassword)
-}
-
-exports.doLogin = handler.doLogin
-
-exports.middleware = async function authMiddleware(req, res, next) {
-  req.query = req.query || {}
-  const token = req.query['token'] || req.headers['x-access-token']
-  delete req.query['token']
-  delete req.headers['x-access-token']
-  let payload
-  try {
-    payload = await handler.isLoggedIn(token, req.getSetting('jwt_secret'))
-  }
-  catch(e) {
-    req.uerror = e.message
-  }
-  if (payload) {
-    let user
-    try {
-      user = await req.db[payload.collection].get(payload._id)
-    } catch (e) {
-      req.uerror = 'user no longer exists'
-    }
-    if (user) {
-      if (req.getSetting('jwt_expire_on_password_change') && user.meta.password_last_updated_at !== payload.timestamp) {
-        req.uerror = 'jwt expired'
-      }
-      if (!req.uerror) {
-        req.uid = payload._id
-        req.ucollection = payload.collection
-        req.user = user
-      }
-    }
-  }
-  next()
-}
+const bcrypt = require('bcryptjs')
+const handler = require('./jwt')
+
+exports.isHashed = function (string) {
+  return string && string.length === 60 && string[0] === '$'
+}
+
+exports.createHash = function (password) {
+  const salt = bcrypt.genSaltSync(10)
+  return bcrypt.hashSync(password, salt)
+}
+
+exports.isValidPassword = function (password, hashedPassword) {
+  return bcrypt.compareSync(password, hashedPassword)
+}
+
+exports.doLogin = handler.doLogin
+
+exports.middleware = async function authMiddleware(req, res, next) {
+  req.query = req.query || {}
+  const token = req.query['token'] || req.headers['x-access-token']
+  delete req.query['token']
+  delete req.headers['x-access-token']
+  let payload
+  try {
+    payload = await handler.isLoggedIn(token, req.getSetting('jwt_secret'))
+  }
+  catch(e) {
+    req.uerror = e.message
+  }
+  if (payload) {
+    let user
+    try {
+      user = await req.db[payload.collection].get(payload._id)
+    } catch (e) {
+      req.uerror = 'user no longer exists'
+    }
+    if (user) {
+      if (req.getSetting('jwt_expire_on_password_change') && user.meta.password_last_updated_at !== payload.timestamp) {
+        req.uerror = 'jwt expired'
+      }
+      if (!req.uerror) {
+        req.uid = payload._id
+        req.ucollection = payload.collection
+        req.user = user
+      }
+    }
+  }
+  next()
+}

package/db/file.js

@@ -5,8 +5,6 @@ Store.prototype.allAsync = promisify(Store.prototype.all)
 Store.prototype.getAsync = promisify(Store.prototype.get)
 Store.prototype.saveAsync = promisify(Store.prototype.save)
 
-const sift = require('sift')
-
 const util = require('../util')
 
 module.exports = function (settings, collection) {
@@ -25,7 +23,7 @@ module.exports = function (settings, collection) {
       const arr = Object.keys(data).map(function (id) {
         return data[id]
       })
-      let matches = sift(query || {}, arr)
+      let matches = util.mongoSearch(arr, query)
       if (orderby) {
         matches = util.orderBy(matches, orderby)
       }
@@ -96,7 +94,7 @@ module.exports = function (settings, collection) {
     updateWithQuery: async function (query, update, options) {
       const data = await store.allAsync()
       const arr = Object.keys(data).map((id) => ({ _id: id, ...data[id]}) )
-      const matches = sift(query || {}, arr)
+      const matches = util.mongoSearch(arr, query)
       const promises = matches.map((doc) => {
         util.mongoUpdate(doc, update)
         return store.saveAsync(doc._id, doc)

package/db/memory.js

@@ -1,6 +1,4 @@
 /* eslint no-unused-vars: ["error", { "args": "none" }] */
-const sift = require('sift')
-
 const util = require('../util')
 
 module.exports = function (settings, collection) {
@@ -14,7 +12,7 @@ module.exports = function (settings, collection) {
     },
     find: async function (query, offset, limit, orderby, fields) {
       const arr = Object.values(store)
-      let matches = sift(query || {}, arr)
+      let matches = util.mongoSearch(arr, query)
       if (orderby) {
         matches = util.orderBy(matches, orderby)
       }
@@ -61,7 +59,7 @@ module.exports = function (settings, collection) {
     // https://docs.mongodb.com/manual/reference/method/db.collection.updateMany/
     updateWithQuery: async function (query, update, options) {
       const arr = Object.keys(store).map((id) => ({ _id: id, ...store[id]}) )
-      const matches = sift(query || {}, arr)
+      const matches = util.mongoSearch(arr, query)
       matches.forEach((doc) => {
         util.mongoUpdate(doc, update)
         store[doc._id] = doc

package/db/postgres.js

@@ -1,100 +1,93 @@
-const mongoToPostgres = require('mongo-query-to-postgres-jsonb')
-const util = require('../util')
-
-module.exports = function (settings, collectionId, collection) {
-  const pool = util.getPgPool(settings.postgresql_uri)
-
-  return {
-    init: async function () {
-      if (collection.plainStringIds) {
-        await pool.query('CREATE TABLE IF NOT EXISTS ' + collectionId + ' (id text primary key, data jsonb)')
-      } else {
-        await pool.query('CREATE TABLE IF NOT EXISTS ' + collectionId + ' (id uuid primary key, data jsonb)')
-      }
-    },
-    all: async function () {
-      return this.find({})
-    },
-    find: async function (rawQuery, offset, limit, orderby, fields) {
-      const arrayFields = util.getArrayPaths('', collection.schema)
-      const pgQuery = mongoToPostgres('data', rawQuery || {}, arrayFields)
-      const select = fields ? mongoToPostgres.convertSelect('data', fields, arrayFields) : '*'
-      let query = 'SELECT ' + select + ' FROM ' + collectionId + (pgQuery ? ' WHERE ' + pgQuery : '')
-      if (typeof orderby !== 'undefined') {
-        query += ' ORDER BY '
-        query += orderby.map((ordering) => {
-          return mongoToPostgres.convertDotNotation('data', ordering[0]) + (ordering[1] > 0 ? ' ASC' : ' DESC')
-        }).join(', ')
-      }
-      if (typeof offset !== 'undefined') {
-        query += ' OFFSET ' + offset
-      }
-      if (typeof limit !== 'undefined') {
-        query += ' LIMIT ' + limit
-      }
-      const result = await pool.query(query)
-      return result.rows.map((row) => row.data)
-    },
-    count: async function(rawQuery, offset, limit) {
-      const arrayFields = util.getArrayPaths('', collection.schema)
-      const pgQuery = mongoToPostgres('data', rawQuery || {}, arrayFields)
-      let query = 'SELECT COUNT(*) FROM ' + collectionId + (pgQuery ? ' WHERE ' + pgQuery : '')
-      if (typeof offset !== 'undefined') {
-        query += ' OFFSET ' + offset
-      }
-      if (typeof limit !== 'undefined') {
-        query += ' LIMIT ' + limit
-      }
-      const result = await pool.query(query)
-      return parseInt(result.rows[0].count)
-    },
-    get: async function (id, fields) {
-      const arrayFields = util.getArrayPaths('', collection.schema)
-      const select = fields ? mongoToPostgres.convertSelect('data', fields, arrayFields) : '*'
-      const result = await pool.query(`SELECT ${select} FROM ${collectionId} WHERE id = $1`, [id])
-      if (result.rowCount === 0) {
-        throw new util.ApiError(404, 'document not found')
-      }
-      return result.rows[0].data
-    },
-    create: async function (data) {
-      util.addIdIfMissing(data)
-      try {
-        await pool.query('INSERT INTO ' + collectionId + ' (id, data) VALUES ($1, $2)', [data._id, data])
-      } catch (e) {
-        if (e.message.includes('duplicate key')) {
-          throw new util.ApiError(409, 'document already exists')
-        }
-        throw e
-      }
-      return data._id
-    },
-    update: async function (id, data) {
-      if (typeof data._id === 'undefined') {
-        data._id = id
-      }
-      const result = await pool.query('UPDATE ' + collectionId + ' SET data=$2,id=$3 WHERE id=$1', [id, data, data._id])
-      if (result.rowCount === 0) {
-        throw new util.ApiError(404, 'document not found')
-      }
-      return data
-    },
-    // eslint-disable-next-line no-unused-vars
-    updateWithQuery: async function (query, update, options) {
-      const arrayFields = util.getArrayPaths('', collection.schema)
-      const pgQuery = mongoToPostgres('data', query || {}, arrayFields)
-      const updateSql = mongoToPostgres.convertUpdate('data', update,false)
-      const result = await pool.query('UPDATE ' + collectionId + ' SET data=' + updateSql + ' WHERE ' + pgQuery)
-      return {
-        matchedCount: result.rowCount
-      }
-    },
-    delete: async function (id) {
-      const result = await pool.query('DELETE FROM ' + collectionId + ' WHERE id=$1', [id])
-      if (result.rowCount === 0) {
-        throw new util.ApiError(404, 'document not found')
-      }
-      return 'OK'
-    }
-  }
-}
+const util = require('../util')
+
+module.exports = function (settings, collectionId, collection) {
+  const pool = util.getPgPool(settings.postgresql_uri)
+
+  return {
+    init: async function () {
+      if (collection.plainStringIds) {
+        await pool.query('CREATE TABLE IF NOT EXISTS ' + collectionId + ' (id text primary key, data jsonb)')
+      } else {
+        await pool.query('CREATE TABLE IF NOT EXISTS ' + collectionId + ' (id uuid primary key, data jsonb)')
+      }
+    },
+    all: async function () {
+      return this.find({})
+    },
+    find: async function (rawQuery, offset, limit, orderby, fields) {
+      const pgSelect = util.mongoToPostgresSelect(collectionId, fields)
+      const pgWhere = util.mongoToPostgresWhere(collectionId, rawQuery)
+      let query = 'SELECT ' + pgSelect + ' FROM ' + collectionId + (pgWhere ? ' WHERE ' + pgWhere : '')
+      if (typeof orderby !== 'undefined') {
+        query += ' ORDER BY '
+        query += util.mongoToPostgresOrderBy(collectionId, orderby)
+      }
+      if (typeof offset !== 'undefined') {
+        query += ' OFFSET ' + offset
+      }
+      if (typeof limit !== 'undefined') {
+        query += ' LIMIT ' + limit
+      }
+      const result = await pool.query(query)
+      return result.rows.map((row) => row.data)
+    },
+    count: async function(rawQuery, offset, limit) {
+      const pgWhere = util.mongoToPostgresWhere(collectionId, rawQuery)
+      let query = 'SELECT COUNT(*) FROM ' + collectionId + (pgWhere ? ' WHERE ' + pgWhere : '')
+      if (typeof offset !== 'undefined') {
+        query += ' OFFSET ' + offset
+      }
+      if (typeof limit !== 'undefined') {
+        query += ' LIMIT ' + limit
+      }
+      const result = await pool.query(query)
+      return parseInt(result.rows[0].count)
+    },
+    get: async function (id, fields) {
+      const pgSelect = util.mongoToPostgresSelect(collectionId, fields)
+      const result = await pool.query(`SELECT ${pgSelect} FROM ${collectionId} WHERE id = $1`, [id])
+      if (result.rowCount === 0) {
+        throw new util.ApiError(404, 'document not found')
+      }
+      return result.rows[0].data
+    },
+    create: async function (data) {
+      util.addIdIfMissing(data)
+      try {
+        await pool.query('INSERT INTO ' + collectionId + ' (id, data) VALUES ($1, $2)', [data._id, data])
+      } catch (e) {
+        if (e.message.includes('duplicate key')) {
+          throw new util.ApiError(409, 'document already exists')
+        }
+        throw e
+      }
+      return data._id
+    },
+    update: async function (id, data) {
+      if (typeof data._id === 'undefined') {
+        data._id = id
+      }
+      const result = await pool.query('UPDATE ' + collectionId + ' SET data=$2,id=$3 WHERE id=$1', [id, data, data._id])
+      if (result.rowCount === 0) {
+        throw new util.ApiError(404, 'document not found')
+      }
+      return data
+    },
+    // eslint-disable-next-line no-unused-vars
+    updateWithQuery: async function (query, update, options) {
+      const pgWhere = util.mongoToPostgresWhere(collectionId, query)
+      const updateSql = util.mongoToPostgresUpdate(collectionId, update)
+      const result = await pool.query('UPDATE ' + collectionId + ' SET data=' + updateSql + ' WHERE ' + pgWhere)
+      return {
+        matchedCount: result.rowCount
+      }
+    },
+    delete: async function (id) {
+      const result = await pool.query('DELETE FROM ' + collectionId + ' WHERE id=$1', [id])
+      if (result.rowCount === 0) {
+        throw new util.ApiError(404, 'document not found')
+      }
+      return 'OK'
+    }
+  }
+}

package/index.js

@@ -113,8 +113,6 @@ module.exports.api = function (settings) {
     get pgpool() {
       return util.getPgPool(router.settings.postgresql_uri)
     },
-    doLogin: auth.doLogin,
-    createHash: auth.createHash,
     ...util,
   }
   router.eventListeners = {}

package/listeners_users.js

@@ -13,7 +13,7 @@ module.exports = async function(api) {
         data.password = oldData.password // preserve password if not explicitly set
       }
     }
-    if (data.password && data.password.length !== 60 && data.password[0] !== '$') {
+    if (!auth.isHashed(data.password)) {
       debug('hashing and replacing password in the user document.')
       data.password = auth.createHash(data.password)
       data.meta.password_last_updated_at = new Date().toISOString()

package/listeners_validation.js

@@ -18,13 +18,13 @@ module.exports = async function (api) {
   const collections = await api.db.collection.all()
   collections.forEach((collection) => {
     const schema = addImplicitFields(collection.schema)
-    util.addSchemaValidator(collection._id, schema)
+    util.addSchema(collection._id, schema)
   })
 
   // Load new and update validators as necessary
   api.addCollectionListener('changed', 'collection', function updateSchemaValidators (req, collection, data) {
     const schema = addImplicitFields(data.schema)
-    util.addSchemaValidator(data._id, schema)
+    util.addSchema(data._id, schema)
   })
 
   api.addCollectionListener('get', ['collection', 'schemas'], function ensureIdAdded (req, collection, data) {

package/modules/admin/package.json

@@ -59,7 +59,7 @@
     "friendly-errors-webpack-plugin": "1.7.0",
     "html-webpack-plugin": "^4.0.0",
     "mini-css-extract-plugin": "0.4.1",
-    "node-notifier": "5.2.1",
+    "node-notifier": "8.0.1",
     "node-sass": "^6.0.1",
     "optimize-css-assets-webpack-plugin": "5.0.0",
     "ora": "3.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expressa",
-  "version": "2.0.6",
+  "version": "2.0.8",
   "description": "API framework using JSON schemas",
   "main": "index.js",
   "repository": "https://github.com/thomas4019/expressa",

package/util.js

@@ -1,4 +1,3 @@
-const randomstring = require('randomstring')
 const {v4} = require('uuid')
 const debug = require('debug')('expressa')
 const crypto = require('crypto')
@@ -6,6 +5,9 @@ const pg = require('pg')
 const pgPools = {}
 const dot = require('dot-object')
 const mongoQuery = require('mongo-query')
+const mongoToPostgres = require('mongo-query-to-postgres-jsonb')
+const sift = require('sift')
+const auth = require('./auth/index')
 const Ajv = require('ajv')
 const ajv = new Ajv({
   allErrors: true,
@@ -31,9 +33,11 @@ ajv.addKeyword({
 const formatKey = ajv.getKeyword('format')
 formatKey.type = formatKey.type.concat(['array', 'boolean', 'object'])
 
+const schemas = {}
 const schemaValidators = {}
 
-exports.addSchemaValidator = function(collection, schema) {
+exports.addSchema = function(collection, schema) {
+  schemas[collection] = schema
   schemaValidators[collection] = ajv.compile(schema)
 }
 
@@ -139,6 +143,27 @@ function _exclude(obj, source) {
   return data
 }
 
+exports.mongoToPostgresSelect = function(collection, fields) {
+  const arrayFields = exports.getArrayPaths('', schemas[collection])
+  return fields ? mongoToPostgres.convertSelect('data', fields, arrayFields) : '*'
+}
+
+exports.mongoToPostgresUpdate = function(collection, query) {
+  return mongoToPostgres.convertUpdate('data', query,false)
+}
+
+exports.mongoToPostgresWhere = function(collection, query) {
+  const arrayFields = exports.getArrayPaths('', schemas[collection])
+  return mongoToPostgres('data', query || {}, arrayFields)
+}
+
+exports.mongoToPostgresOrderBy = function(collection, orderby) {
+  const normalizedOrderBy = exports.normalizeOrderBy(orderby)
+  return normalizedOrderBy.map((ordering) => {
+    return mongoToPostgres.convertDotNotation('data', ordering[0]) + (ordering[1] > 0 ? ' ASC' : ' DESC')
+  }).join(', ')
+}
+
 exports.mongoProject = function(record, projection) {
   if (!projection || Object.keys(projection).length < 1) {
     return record
@@ -152,6 +177,10 @@ exports.mongoProject = function(record, projection) {
   return result
 }
 
+exports.mongoSearch = function(docs, query) {
+  return sift(query || {}, docs)
+}
+
 exports.mongoUpdate = function(doc, update) {
   return mongoQuery(doc, {}, update)
 }
@@ -166,6 +195,7 @@ exports.normalizeOrderBy = function(orderby) {
           return [ordering[0], 1] // add 1 (default to ascending sort)
         }
       }
+      // if reaches here, is already normalized
       return ordering
     })
   } else if (typeof orderby === 'object') {
@@ -423,3 +453,7 @@ exports.createPagePagination = function createPagePagination (pageData, page, pa
 exports.getDatabaseOffset = function getDatabaseOffset(page, itemsPerPage) {
   return (page - 1) * itemsPerPage
 }
+
+exports.createHash = auth.createHash
+exports.isHashed = auth.isHashed
+exports.doLogin = auth.doLogin