forms-angular 0.12.0-beta.246 → 0.12.0-beta.248

package/dist/server/data_form.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FormsAngular = void 0;
 const mongoose_1 = require("mongoose");
-// This part of forms-angular borrows _very_ heavily from https://github.com/Alexandre-Strzelewicz/angular-bridge
+// This part of forms-angular borrows from https://github.com/Alexandre-Strzelewicz/angular-bridge
 // (now https://github.com/Unitech/angular-bridge
 const _ = require('lodash');
 const util = require('util');
@@ -907,7 +907,7 @@ class FormsAngular {
         }
     }
     ;
-    sanitisePipeline(aggregationParam, hiddenFields, findFuncQry) {
+    async sanitisePipeline(aggregationParam, hiddenFields, findFuncQry, req) {
         let that = this;
         let array = Array.isArray(aggregationParam) ? aggregationParam : [aggregationParam];
         let retVal = [];
@@ -922,9 +922,16 @@ class FormsAngular {
                 throw new Error('Invalid pipeline instruction');
             }
             switch (keys[0]) {
-                case '$merge':
-                case '$out':
-                    throw new Error('Cannot use potentially destructive pipeline stages');
+                case '$project':
+                case '$addFields':
+                case '$count':
+                case "$group":
+                case "$limit":
+                case "$replaceRoot":
+                case "$sort":
+                case "$unwind":
+                    // We don't care about these - they are all (as far as we know) safe
+                    break;
                 case '$unionWith':
                     /*
                       Sanitise the pipeline we are doing a union with, removing hidden fields from that collection
@@ -940,7 +947,7 @@ class FormsAngular {
                             unionHiddenLookupFields = this.generateHiddenFields(unionResource, false);
                         }
                     }
-                    stage.$unionWith.pipeline = that.sanitisePipeline(stage.$unionWith.pipeline, unionHiddenLookupFields, findFuncQry);
+                    stage.$unionWith.pipeline = await that.sanitisePipeline(stage.$unionWith.pipeline, unionHiddenLookupFields, findFuncQry, req);
                     break;
                 case '$match':
                     this.hackVariables(array[pipelineSection]['$match']);
@@ -954,14 +961,24 @@ class FormsAngular {
                     stage = null;
                     break;
                 case '$lookup':
+                case '$graphLookup':
+                    if (keys[0] === '$lookup') {
+                        // For now at least, we only support simple $lookups with a single join field equality
+                        let lookupProps = Object.keys(stage.$lookup);
+                        if (lookupProps.length !== 4 || lookupProps.indexOf('from') === -1 || lookupProps.indexOf('localField') === -1 || lookupProps.indexOf('foreignField') === -1 || lookupProps.indexOf('as') === -1) {
+                            throw new Error("No support for $lookup that isn't Equality Match with a Single Join Condition");
+                        }
+                    }
                     // hide any hiddenfields in the lookup collection
-                    const collectionName = stage.$lookup.from;
-                    const lookupField = stage.$lookup.as;
+                    const collectionName = stage[keys[0]].from;
+                    const lookupField = stage[keys[0]].as;
                     if ((collectionName + lookupField).indexOf('$') !== -1) {
                         throw new Error('No support for lookups where the "from" or "as" is anything other than a simple string');
                     }
                     const resource = that.getResourceFromCollection(collectionName);
                     if (resource) {
+                        retVal.push(stage);
+                        stage = null;
                         if (resource.options?.hide?.length > 0) {
                             const hiddenLookupFields = this.generateHiddenFields(resource, false);
                             let hiddenFieldsObj = {};
@@ -970,11 +987,45 @@ class FormsAngular {
                             });
                             retVal.push({ $project: hiddenFieldsObj });
                         }
+                        // Now we need to make sure that we restrict the lookup to documents we have access to
+                        if (resource.options.findFunc) {
+                            // If the next stage is an $unwind
+                            let nextStageIsUnwind = false;
+                            if (array.length >= pipelineSection) {
+                                const nextStage = array[pipelineSection + 1];
+                                let nextKeys = Object.keys(nextStage);
+                                if (nextKeys.length !== 1) {
+                                    throw new Error('Invalid pipeline instruction');
+                                }
+                                if (nextKeys[0] === '$unwind') {
+                                    if (nextStage["$unwind"] === "$" + lookupField) {
+                                        nextStageIsUnwind = true;
+                                    }
+                                    if (nextStage["$unwind"] && nextStage["$unwind"].path === "$" + lookupField) {
+                                        nextStageIsUnwind = true;
+                                    }
+                                }
+                            }
+                            if (!nextStageIsUnwind) {
+                                throw new Error('No support for $lookup where the next stage is not an $unwind and the resources has a findFunc');
+                            }
+                            // Push the $unwind, add our own findFunc, and increment the pipelineStage counter
+                            retVal.push({ $unwind: "$" + lookupField });
+                            const lookedUpFindQry = await this.doFindFuncPromise(req, resource);
+                            // Now we need to put the lookup base into the criteria
+                            for (const prop in lookedUpFindQry) {
+                                if (lookedUpFindQry.hasOwnProperty(prop)) {
+                                    lookedUpFindQry[`${lookupField}.${prop}`] = lookedUpFindQry[prop];
+                                    delete lookedUpFindQry[prop];
+                                }
+                            }
+                            retVal.push({ $match: lookedUpFindQry });
+                        }
                     }
                     break;
                 default:
-                    // nothing
-                    break;
+                    // anything else is either known to be dangerous, not yet needed or we don't know what it is
+                    throw new Error('Unsupported pipeline instruction ' + keys[0]);
             }
             if (stage) {
                 retVal.push(stage);
@@ -1040,13 +1091,18 @@ class FormsAngular {
                 let hiddenFields = self.generateHiddenFields(resource, false);
                 let toDo = {
                     runAggregation: function (cb) {
-                        runPipelineObj = self.sanitisePipeline(runPipelineObj, hiddenFields, queryObj);
-                        resource.model.aggregate(runPipelineObj)
-                            .then((results) => {
-                            cb(null, results);
+                        self.sanitisePipeline(runPipelineObj, hiddenFields, queryObj, req)
+                            .then((runPipelineObj) => {
+                            resource.model.aggregate(runPipelineObj)
+                                .then((results) => {
+                                cb(null, results);
+                            })
+                                .catch((err) => {
+                                cb(err);
+                            });
                         })
                             .catch((err) => {
-                            cb(err);
+                            throw new Error('Error in sanitisePipeline ' + err);
                         });
                     }
                 };
@@ -1166,7 +1222,6 @@ class FormsAngular {
                         callback(err);
                     }
                     else {
-                        // TODO: Could loop through schema.params and just send back the values
                         callback(null, {
                             success: true,
                             schema: schema,
@@ -1327,13 +1382,26 @@ class FormsAngular {
         }
     }
     ;
-    filteredFind(resource, req, aggregationParam, findParam, projectParam, sortOrder, limit, skip, callback) {
+    async doFindFuncPromise(req, resource) {
+        return new Promise((resolve, reject) => {
+            this.doFindFunc(req, resource, (err, queryObj) => {
+                if (err) {
+                    reject(err);
+                }
+                else {
+                    resolve(queryObj);
+                }
+            });
+        });
+    }
+    ;
+    async filteredFind(resource, req, aggregationParam, findParam, projectParam, sortOrder, limit, skip, callback) {
         const that = this;
         let hiddenFields = this.generateHiddenFields(resource, false);
         let stashAggregationResults;
-        function doAggregation(queryObj, cb) {
+        async function doAggregation(queryObj, cb) {
             if (aggregationParam) {
-                aggregationParam = that.sanitisePipeline(aggregationParam, hiddenFields, queryObj);
+                aggregationParam = await that.sanitisePipeline(aggregationParam, hiddenFields, queryObj, req);
                 resource.model.aggregate(aggregationParam)
                     .then((aggregationResults) => {
                     stashAggregationResults = aggregationResults;

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import { Error, Model, Types } from "mongoose";
+import { Error, FilterQuery, Model, Types } from "mongoose";
 import {Express} from "express";
 
 declare module fngServer {
@@ -52,7 +52,7 @@ declare module fngServer {
         handleRemove?: 'allow' | 'cascade';  // default behaviour is to prevent deletion if record is used as a foreign key
         searchImportance?: boolean | number,
         onSave?: (doc, req, cb) => void,
-        findFunc?: (req, cb) => void,
+        findFunc?: (req: Express.Request, cb: (err:Error, criteria?: FilterQuery<any>) => void) => void,
         getOrgCriteria?: (userOrganisation: string) => Promise<any>
         idIsList?: IIdIsList,
         searchResultFormat?: ISearchResultFormatter,

package/package.json

@@ -3,7 +3,7 @@
   "author": "Mark Chapman <support@forms-angular.org>",
   "description": "A form builder that sits on top of Angular.js, Twitter Bootstrap, jQuery UI, Angular-UI, Express and Mongoose.  Opinionated or what?",
   "homepage": "http://forms-angular.org",
-  "version": "0.12.0-beta.246",
+  "version": "0.12.0-beta.248",
   "engines": {
     "node": ">=8.x",
     "npm": ">=5.x"