fhirsmith 0.17.0 → 0.18.1

package/library/mailer.js

@@ -0,0 +1,77 @@
+// library/mailer.js
+// Outbound email for the server, over SMTP (nodemailer). One of these is made from the
+// top-level "email" block of config.json, and anything that wants to send mail asks it
+// whether it's configured first - a server with no "email" block simply doesn't send.
+//
+//   "email": {
+//     "host": "smtp.example.org",
+//     "port": 587,                  // default 587; 465 implies secure
+//     "secure": false,              // TLS from the start (true for 465), else STARTTLS
+//     "user": "...", "password": "...",   // optional - leave out for an open relay
+//     "from": "FHIRsmith <fhirsmith@example.org>"
+//   }
+//
+// nodemailer is only loaded when a message is actually sent, so a server that doesn't
+// send mail doesn't need it installed.
+
+class Mailer {
+
+  constructor(config, log) {
+    this.config = config || {};
+    this.log = log || console;
+    this.transport = null;
+  }
+
+  /**
+   * Whether enough has been configured to send: a host to send through and an
+   * address to send from.
+   */
+  configured() {
+    return Boolean(this.config.host && this.config.from);
+  }
+
+  _transport() {
+    if (!this.transport) {
+      const nodemailer = require('nodemailer');
+      const port = this.config.port || 587;
+      const options = {
+        host: this.config.host,
+        port: port,
+        secure: this.config.secure ?? (port === 465)
+      };
+      if (this.config.user) {
+        options.auth = {user: this.config.user, pass: this.config.password};
+      }
+      this.transport = nodemailer.createTransport(options);
+    }
+    return this.transport;
+  }
+
+  /**
+   * Send one message. `to` is an address or a list of them; text is the body.
+   * Resolves with nodemailer's result, or throws - callers decide what a
+   * failure means to them.
+   */
+  async send({to, subject, text, html}) {
+    if (!this.configured()) {
+      throw new Error('Email is not configured (email.host and email.from are needed)');
+    }
+    if (!to || (Array.isArray(to) && to.length === 0)) {
+      throw new Error('No recipient given');
+    }
+    const message = {
+      from: this.config.from,
+      to: Array.isArray(to) ? to.join(', ') : to,
+      subject: subject,
+      text: text
+    };
+    if (html) {
+      message.html = html;
+    }
+    const result = await this._transport().sendMail(message);
+    this.log.info(`Email sent to ${message.to}: ${subject}`);
+    return result;
+  }
+}
+
+module.exports = Mailer;

package/library/narrative-check.js

@@ -61,10 +61,29 @@ function urlsIn(name, value) {
   return [value];
 }
 
+// CSS comments removed by a single pass: the obvious regex, /\/\*[\s\S]*?\*\//g, rescans to
+// the end of the string for every unterminated '/*', which is quadratic - a style attribute
+// of a few hundred KB of '/* ' held the event loop for seconds
+function stripCssComments(css) {
+  let out = '';
+  let i = 0;
+  for (;;) {
+    const start = css.indexOf('/*', i);
+    if (start < 0) {
+      return out + css.substring(i);
+    }
+    out += css.substring(i, start);
+    const end = css.indexOf('*/', start + 2);
+    if (end < 0) {
+      return out;
+    }
+    i = end + 2;
+  }
+}
+
 // CSS with comments removed and escapes decoded, so \65 xpression( is seen as expression(
 function normaliseCss(css) {
-  return String(css)
-    .replace(/\/\*[\s\S]*?\*\//g, '')
+  return stripCssComments(String(css))
     .replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_, hex) => {
       const cp = parseInt(hex, 16);
       return cp > 0 && cp <= 0x10ffff ? String.fromCodePoint(cp) : '';

package/library/npm-audit.js

@@ -371,6 +371,31 @@ class NpmAudit {
     return this.findings.some(f => f.severity === 'critical' || f.severity === 'high');
   }
 
+  /**
+   * For the daily report: plain text, and only when there's something to act
+   * on - packages with known vulnerabilities (and what to do about them), a
+   * check that couldn't be run, or a newer FHIRsmith release. '' otherwise.
+   */
+  reportText() {
+    if (!this.enabled) {
+      return '';
+    }
+    const sentences = [];
+    if (this.findings.length > 0) {
+      const list = this.findings.map(f => `${f.name} ${f.installed.join('/')} (${f.severity}: ${f.range})`).join(', ');
+      sentences.push(`npm audit found ${this.summary()} in the packages this server uses: ${list}. ${this.advice()}`);
+    }
+    if (this.lastError) {
+      sentences.push(this.checkedAt
+        ? `The latest npm audit check failed: ${this.lastError}.`
+        : `The npm audit check could not be run: ${this.lastError}.`);
+    }
+    if (this.findings.length === 0 && this.installedVersion && compareVersions(this.installedVersion, this.latestVersion) < 0) {
+      sentences.push(`FHIRsmith ${this.latestVersion} is available (this server is running ${this.installedVersion}).`);
+    }
+    return sentences.join(' ');
+  }
+
   /**
    * Home page: nothing unless there is something to report
    */

package/library/package-manager.js

@@ -520,8 +520,10 @@ class PackageManager {
         const packagePath = path.join(this.cacheFolder, packageName);
 
         try {
-            const stats = await fs.stat(packagePath);
-            if (stats.isDirectory()) {
+            // the folder alone is not enough: a download that failed after the folder was made
+            // leaves an empty one, which must not count as the package
+            const stats = await fs.stat(path.join(packagePath, 'package', 'package.json'));
+            if (stats.isFile()) {
                 return packageName;
             }
         } catch (error) {

package/library/sqlite-session-store.js

@@ -130,4 +130,32 @@ class SqliteSessionStore extends session.Store {
   }
 }
 
-module.exports = { SqliteSessionStore };
+/**
+ * The callback API this store uses (run, get), over a better-sqlite3 database - for the
+ * modules that keep their data with better-sqlite3 rather than sqlite3.
+ * @param {object} db - an open better-sqlite3 Database
+ */
+function betterSqlite(db) {
+  return {
+    run(sql, params, cb) {
+      let info;
+      try {
+        info = db.prepare(sql).run(...params);
+      } catch (e) {
+        return cb(e);
+      }
+      cb.call(info, null);
+    },
+    get(sql, params, cb) {
+      let row;
+      try {
+        row = db.prepare(sql).get(...params);
+      } catch (e) {
+        return cb(e);
+      }
+      cb(null, row);
+    }
+  };
+}
+
+module.exports = { SqliteSessionStore, betterSqlite };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fhirsmith",
-  "version": "0.17.0",
-  "txVersion": "1.9.6",
+  "version": "0.18.1",
+  "txVersion": "1.10.0",
   "description": "A Node.js server that provides a collection of tools to serve the FHIR ecosystem",
   "main": "server.js",
   "engines": {
@@ -19,6 +19,8 @@
     "test:xig": "jest --testPathPatterns=xig",
     "test:packages": "jest --testPathPatterns=packages",
     "test:token": "jest --testPathPatterns=token",
+    "test:testing": "jest --testPathPatterns=tests/testing",
+    "test:ips": "jest --testPathPatterns=tests/ips",
     "test:integration": "jest --testPathPatterns=integration",
     "test:unit": "jest --testPathPatterns=unit",
     "lint": "eslint . --ext .js --ignore-path .gitignore",
@@ -46,15 +48,17 @@
     "express-rate-limit": "^7.4.1",
     "express-session": "^1.19.0",
     "fast-xml-parser": "^5.3.4",
-    "fhir-validator-wrapper": "1.4.0",
+    "fhir-validator-wrapper": "1.5.0",
     "fhirpath": "^5.2.1",
     "fs-extra": "^11.3.3",
     "ini": "^6.0.0",
     "inquirer": "^8.2.5",
+    "jose": "^5.10.0",
     "liquidjs": "^10.25.5",
     "lusca": "^1.7.0",
     "natural": "^8.1.1",
     "node-cron": "^4.6.0",
+    "nodemailer": "^10.2.0",
     "pako": "^2.1.0",
     "parse5": "^7.3.0",
     "passport": "^0.7.0",
@@ -62,6 +66,7 @@
     "passport-github2": "^0.1.12",
     "passport-google-oauth20": "^2.0.0",
     "properties-file": "^3.6.4",
+    "qrcode-generator": "^2.0.4",
     "re2js": "^2.8.0",
     "rimraf": "^5.0.10",
     "sqlite3": "^6.0.1",

package/packages/packages.js

@@ -1282,11 +1282,15 @@ class PackagesModule {
 
         next();
         pckLog.info(`/download/${id}/${version}`);
-      } finally {
+      } catch (error) {
         this.stats.countRequest('version', Date.now() - start);
+        throw error;
       }
     }, async (req, res) => {
       const start = Date.now();
+      // counted as 'download' (the tarball) or 'version' (its JSON document) - the
+      // daily report counts the downloads as packages served
+      let name = 'version';
       try {
         try {
           const {id, version} = req.params;
@@ -1297,6 +1301,7 @@ class PackagesModule {
             await this.serveVersionDocument(req.secure, id, version, req, res);
             pckLog.info(`/version/${id}/${version}`);
           } else {
+            name = 'download';
             await this.serveDownload(req.secure, id, version, res);
             pckLog.info(`/download/${id}/${version}`);
           }
@@ -1305,7 +1310,7 @@ class PackagesModule {
           res.status(500).json({error: 'Internal server error'});
         }
       } finally {
-        this.stats.countRequest('version', Date.now() - start);
+        this.stats.countRequest(name, Date.now() - start);
       }
     });
 
@@ -1322,8 +1327,9 @@ class PackagesModule {
 
         next();
         pckLog.info(`/page/${page}`);
-      } finally {
+      } catch (error) {
         this.stats.countRequest('page', Date.now() - start);
+        throw error;
       }
     }, async (req, res) => {
       const start = Date.now();
@@ -2805,6 +2811,31 @@ class PackagesModule {
     return va.pre.localeCompare(vb.pre, undefined, { numeric: true });
   }
 
+  /**
+   * The paragraph for the server's daily report: packages served (tarball
+   * downloads) and package versions newly indexed by the crawler in the period.
+   */
+  async dailyReport({since, now}) {
+    const {plural} = require('../library/daily-report');
+    const counts = this.stats.countsSince(since, now);
+    const downloads = counts.operations.download || 0;
+    const sentences = [`${plural(downloads, 'package')} ${downloads === 1 ? 'was' : 'were'} served (${plural(counts.total, 'request')} in all).`];
+    if (this.db) {
+      try {
+        const row = await new Promise((resolve, reject) => this.db.get(
+          'SELECT COUNT(*) AS n, COUNT(DISTINCT Id) AS ids FROM PackageVersions WHERE Indexed > ?',
+          [new Date(since).toISOString().replace('T', ' ').substring(0, 19)],
+          (err, row) => err ? reject(err) : resolve(row)));
+        sentences.push(row.n === 0
+          ? 'No new package versions were found.'
+          : `${plural(row.n, 'new package version')} ${row.n === 1 ? 'was' : 'were'} found, of ${plural(row.ids, 'package')}.`);
+      } catch (e) {
+        sentences.push(`The new packages could not be counted: ${e.message}.`);
+      }
+    }
+    return sentences.join(' ');
+  }
+
   async shutdown() {
     pckLog.info('Shutting down Packages module...');
 

package/publisher/publisher.js

@@ -2987,6 +2987,35 @@ class PublisherModule {
     });
   }
 
+  /**
+   * The paragraph for the server's daily report: publication runs started in
+   * the period, and how many finished successfully.
+   */
+  async dailyReport({since, now}) {
+    const {plural} = require('../library/daily-report');
+    if (!this.db) {
+      return 'The database is not open.';
+    }
+    const get = (sql, params) => new Promise((resolve, reject) =>
+      this.db.get(sql, params, (err, row) => err ? reject(err) : resolve(row)));
+    // the timestamps are CURRENT_TIMESTAMP: UTC, 'YYYY-MM-DD HH:MM:SS'
+    const utc = ms => new Date(ms).toISOString().replace('T', ' ').substring(0, 19);
+    try {
+      const started = await get('SELECT COUNT(*) AS n FROM tasks WHERE building_at > ? AND building_at <= ?', [utc(since), utc(now)]);
+      const finished = await get('SELECT COUNT(*) AS n FROM tasks WHERE completed_at > ? AND completed_at <= ?', [utc(since), utc(now)]);
+      const failed = await get('SELECT COUNT(*) AS n FROM tasks WHERE failed_at > ? AND failed_at <= ?', [utc(since), utc(now)]);
+      const waiting = await get("SELECT COUNT(*) AS n FROM tasks WHERE status IN ('queued', 'waiting for approval')", []);
+      let text = `${plural(started.n, 'publication run')} ${started.n === 1 ? 'was' : 'were'} started, and ${finished.n} finished successfully`;
+      text += failed.n > 0 ? ` (${failed.n} failed).` : '.';
+      if (waiting.n > 0) {
+        text += ` ${plural(waiting.n, 'task')} ${waiting.n === 1 ? 'is' : 'are'} queued or waiting for approval.`;
+      }
+      return text;
+    } catch (e) {
+      return `The database could not be read: ${e.message}.`;
+    }
+  }
+
   async shutdown() {
     this.logger.info('Shutting down publisher module...');