hola-server 0.6.9 → 0.6.12

package/core/meta.js

@@ -1,6 +1,6 @@
 const { is_undefined } = require('./validate');
 const { get_type } = require('./type');
-const { is_valid_role } = require('../setting');
+const { validate_meta_role } = require('./role');
 
 const meta_manager = {};
 /**
@@ -13,6 +13,7 @@ const meta_manager = {};
  * create is false, this attribute can be shown in property list but sys property can't be shown in property list 
  * secure: secure properties will not be read by client, this is useful for password
  * group: this is used to control user sharing entities, this means the entity is shared by user group, this is only valid for user field
+ * view: this is used to control for edit form, for one entity, may have many forms to edit the entity, so use view to seperate them, this can be string or array
  * 
  * routes: configure customer defined routes
  * link property: field link property link to entity field and the field should ref to an entity.
@@ -20,7 +21,7 @@ const meta_manager = {};
  * 
  * 
 */
-const field_attrs = ["name", "type", "required", "ref", "link", "delete", "create", "list", "search", "update", "clone", "sys", "secure", "group"];
+const field_attrs = ["name", "type", "required", "ref", "link", "delete", "create", "list", "search", "update", "clone", "sys", "secure", "group", "view"];
 const meta_attrs = ["collection", "roles", "primary_keys", "fields", "creatable", "readable", "updatable", "deleteable", "cloneable", "after_read",
     "before_create", "after_create", "before_clone", "after_clone", "before_update", "after_update", "before_delete", "after_delete", "create", "clone", "update", "batch_update", "after_batch_update", "delete",
     "ref_label", "ref_filter", "route", "user_field"];
@@ -90,6 +91,19 @@ const validate_field = (meta, field) => {
         });
     }
 
+    const editable = field.create || field.update;
+
+    if (field.view) {
+        if (!editable) {
+            throw new Error("view can just defined for editable (create/update) field only. Field:" + JSON.stringify(field) + "] and meta:" + meta.collection);
+        }
+    } else {
+        //no view defined for create/update field, then set view to default value "0"
+        if (editable) {
+            field.view = "0";
+        }
+    }
+
     const keys = Object.keys(field);
     keys.forEach(key => {
         if (!field_attrs.includes(key)) {
@@ -191,6 +205,7 @@ const get_all_metas = () => {
     return Object.keys(meta_manager);
 }
 
+
 /**
  * Wrap the meta info from user side:
  * 1) validate the meta structure and keep it is valid
@@ -212,6 +227,18 @@ class EntityMeta {
         this.exportable = is_undefined(meta.exportable) ? false : meta.exportable;
         this.editable = this.creatable || this.updatable;
 
+        //b:batch mode, c:create, d:delete, e:export, i:import, o:clone, p:page, r: refresh, s:search, u:update
+        const modes = [];
+        this.creatable && (modes.push("c"));
+        //prefer the infinite scrolling mode, so doesn't include p mode
+        this.readable && (modes.push("rs"));
+        this.updatable && (modes.push("u"));
+        this.deleteable && (modes.push("db"));
+        this.cloneable && (modes.push("o"));
+        this.importable && (modes.push("i"));
+        this.exportable && (modes.push("e"));
+        this.mode = modes.join("");
+
         this.ref_label = this.meta.ref_label;
         this.ref_filter = this.meta.ref_filter;
         this.ref_fields = this.meta.fields.filter(field => field.ref);
@@ -287,11 +314,26 @@ class EntityMeta {
             if (!Array.isArray(this.roles)) {
                 throw new Error("roles of meta [" + this.collection + "] should be array");
             }
+
             this.roles.forEach(role => {
                 const role_config = role.split(":");
+                if (role_config.length != 2) {
+                    throw new Error("wrong role config [" + role + "] in meta [" + this.collection + "]. You should use : to seperate the role name with mode.");
+                }
+
                 const role_name = role_config[0];
-                if (!is_valid_role(role_name)) {
-                    throw new Error("role [" + role_name + "] not defined in setting");
+                if (!validate_meta_role(role_name)) {
+                    throw new Error("role [" + role_name + "] in meta [" + this.collection + "] not defined in setting's role config.");
+                }
+
+                const role_mode = role_config[1];
+                if (role_mode != "*") {
+                    for (let i = 0; i < role_mode.length; i++) {
+                        const mode = role_mode.charAt(i);
+                        if (!this.mode.includes(mode)) {
+                            throw new Error("role [" + role_name + "] in meta [" + this.collection + "] with mode [" + mode + "] doesn't comply with entity mode [" + this.mode + "]");
+                        }
+                    }
                 }
             });
         }

package/core/role.js

@@ -0,0 +1,97 @@
+const { get_settings } = require("../setting");
+
+/**
+ * Validate the role defination in meta config
+ * @param {*} role_name 
+ * @returns 
+ */
+const validate_meta_role = (role_name) => {
+    const settings = get_settings();
+    //there is role defined in meta but no roles config in settings
+    if (!settings.roles) {
+        return false;
+    }
+    return is_valid_role(role_name);
+}
+
+const is_valid_role = (role_name) => {
+    const settings = get_settings();
+    const roles = settings.roles.filter(role => role.name == role_name);
+    return roles.length == 1;
+}
+
+const is_root_role = (role_name) => {
+    const settings = get_settings();
+    //no role defined, then there is no role limition, so treat each user as root
+    if (!settings.roles) {
+        return true;
+    }
+
+    if (is_valid_role(role_name)) {
+        return settings.roles.filter(role => role.name == role_name)[0].root == true;
+    } else {
+        return false;
+    }
+}
+
+/**
+ * get user's role from user session
+ * @param {request} req 
+ * @returns 
+ */
+const get_session_user_role = (req) => {
+    const user = req && req.session ? req.session.user : null;
+    return user ? user.role : null;
+}
+
+/**
+ * Get the meta mode based on user's role
+ * @param {request} req 
+ * @param {meta} meta 
+ * @returns 
+ */
+const get_user_role_mode = (req, meta) => {
+    const settings = get_settings();
+    //no role defined in settings or no roles defined in meta, use meta mode
+    if (!settings.roles || !meta.roles) {
+        return meta.mode;
+    }
+
+    const user_role = get_session_user_role(req);
+    if (!user_role) {
+        return "";
+    }
+
+    if (is_valid_role(user_role)) {
+        const roles = meta.roles;
+        for (let i = 0; i < roles.length; i++) {
+            const role = roles[i];
+            const role_settings = role.split(":");
+            const role_name = role_settings[0];
+            const role_mode = role_settings[1];
+            if (user_role == role_name) {
+                // * stands to get the mode from meta definition
+                if (role_mode == "*") {
+                    return meta.mode;
+                } else {
+                    return role_mode;
+                }
+            }
+        }
+    }
+    return "";
+}
+
+/**
+ * Check whether the user has the mode right on the meta or not
+ * @param {http request} req 
+ * @param {meta defination} meta 
+ * @param {meta mode} mode 
+ * @returns 
+ */
+const check_user_role = (req, meta, mode) => {
+    const role_mode = get_user_role_mode(req, meta);
+    return role_mode.includes(mode);
+}
+
+module.exports = { is_root_role, validate_meta_role, check_user_role, get_user_role_mode };

package/db/entity.js

@@ -235,10 +235,11 @@ class Entity {
     /**
     * Validate the param object and invoke the logic to save it to db
     * @param {param obj from user input} param_obj
+    * @param {which view to create the entity} view
     * @returns object with code and err
     */
-    async create_entity(param_obj) {
-        const fields = this.meta.create_fields
+    async create_entity(param_obj, view) {
+        const fields = this.meta.create_fields.filter(field => field.view == view);
         const { obj, error_field_names } = convert_type(param_obj, fields);
         if (error_field_names.length > 0) {
             if (is_log_error()) {
@@ -397,10 +398,13 @@ class Entity {
      * Validate the param object and invoke the logic to update entity
      * @param {object id of the entity} _id object id of the entity, if it is null, then use primary key
      * @param {param object from user input} param_obj 
+     * @param {which view to update the entity} view 
      * 
      */
-    async update_entity(_id, param_obj) {
-        const { obj, error_field_names } = convert_update_type(param_obj, this.meta.update_fields);
+    async update_entity(_id, param_obj, view) {
+        const fields = this.meta.update_fields.filter(field => field.view == view);
+
+        const { obj, error_field_names } = convert_update_type(param_obj, fields);
         if (error_field_names.length > 0) {
             if (is_log_error()) {
                 log_error(LOG_ENTITY, "update_entity error fields:" + JSON.stringify(error_field_names));

package/http/session.js

@@ -1,6 +1,6 @@
 const express_session = require('express-session');
 const MongoStore = require('connect-mongo');
-const { get_settings, is_valid_role, is_root_role } = require('../setting');
+const { get_settings } = require('../setting');
 
 const init_session = (app) => {
     const server = get_settings().server;
@@ -24,54 +24,9 @@ const get_session_userid = (req) => {
     return user ? user.id : null;
 }
 
-const get_session_user_role = (req) => {
-    const user = req && req.session ? req.session.user : null;
-    return user ? user.role : null;
-}
-
-//b:batch mode, c:create, d:delete, e:export, i:import, o:clone, p:page, r: refresh, s:search, u:update
-const mode_all = "bcdeiorsu";
-
-const get_user_role_mode = (req, roles) => {
-    const server = get_settings().server;
-    if (server.check_user == false) {
-        return mode_all;
-    }
-
-    const user_role = get_session_user_role(req);
-    if (!user_role) {
-        return "";
-    }
-
-    if (is_root_role(user_role)) {
-        return mode_all;
-    } else if (is_valid_role(user_role)) {
-        for (let i = 0; i < roles.length; i++) {
-            const role = roles[i];
-            const role_settings = role.split(":");
-            const role_name = role_settings[0];
-            const role_mode = role_settings[1];
-            if (user_role == role_name) {
-                if (role_mode == "*") {
-                    return mode_all;
-                } else {
-                    return role_mode;
-                }
-            }
-        }
-    }
-
-    return "";
-}
-
-const check_user_role = (req, roles, mode) => {
-    const role_mode = get_user_role_mode(req, roles);
-    return role_mode.includes(mode);
-}
-
 const get_session_user_groups = (req) => {
     const group = req && req.session ? req.session.group : null;
     return group && Array.isArray(group) ? group : null;
 }
 
-module.exports = { init_session, get_session_userid, get_session_user_role, get_session_user_groups, check_user_role, get_user_role_mode };
+module.exports = { init_session, get_session_userid, get_session_user_groups };

package/index.js

@@ -1,10 +1,11 @@
 const { get_db } = require('./db/db');
 const { Entity } = require('./db/entity');
-const { init_settings, is_root_role } = require('./setting');
+const { init_settings } = require('./setting');
 const { init_router } = require('./http/router');
 const { init_express_server } = require('./http/express');
 const { register_type, get_type } = require('./core/type');
 const { EntityMeta, get_entity_meta } = require('./core/meta');
+const { is_root_role } = require('./core/role');
 
 
 const array = require('./core/array');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hola-server",
-  "version": "0.6.9",
+  "version": "0.6.12",
   "description": "a meta programming framework used to build nodejs restful api",
   "main": "index.js",
   "scripts": {

package/router/clone.js

@@ -1,9 +1,10 @@
 const { set_file_fields, save_file_fields_to_db } = require('../db/gridfs');
 const { SUCCESS, NO_PARAMS, NO_RIGHTS } = require('../http/code');
-const { get_session_userid, check_user_role } = require('../http/session');
+const { get_session_userid } = require('../http/session');
 const { wrap_http } = require('../http/error');
 const { post_params, required_post_params } = require('../http/params');
 const { has_value } = require('../core/validate');
+const { check_user_role } = require('../core/role');
 const { Entity } = require('../db/entity');
 
 const multer = require('multer');
@@ -19,12 +20,10 @@ const init_clone_router = function (router, meta) {
     const cp_upload = meta.upload_fields.length > 0 ? upload_file.fields(meta.upload_fields) : upload_file.none();
 
     router.post('/clone', cp_upload, wrap_http(async function (req, res) {
-        if (meta.roles) {
-            const has_right = check_user_role(req, meta.roles, "o");
-            if (!has_right) {
-                res.json({ code: NO_RIGHTS, err: "no rights error" });
-                return;
-            }
+        const has_right = check_user_role(req, meta, "o");
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
         }
 
         let params = required_post_params(req, ["_id"]);

package/router/create.js

@@ -1,9 +1,10 @@
 const { set_file_fields, save_file_fields_to_db } = require('../db/gridfs');
 const { SUCCESS, NO_RIGHTS } = require('../http/code');
-const { get_session_userid, check_user_role } = require('../http/session');
+const { get_session_userid } = require('../http/session');
 const { wrap_http } = require('../http/error');
 const { post_params } = require('../http/params');
 const { has_value } = require('../core/validate');
+const { check_user_role } = require('../core/role');
 const { Entity } = require('../db/entity');
 
 const multer = require('multer');
@@ -19,12 +20,16 @@ const init_create_router = function (router, meta) {
     const cp_upload = meta.upload_fields.length > 0 ? upload_file.fields(meta.upload_fields) : upload_file.none();
 
     router.post('/create', cp_upload, wrap_http(async function (req, res) {
-        if (meta.roles) {
-            const has_right = check_user_role(req, meta.roles, "c");
-            if (!has_right) {
-                res.json({ code: NO_RIGHTS, err: "no rights error" });
-                return;
-            }
+        const has_right = check_user_role(req, meta, "c");
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
+        }
+
+        //which view to create the entity
+        let { _view } = post_params(req, ["_view"]);
+        if (!_view) {
+            _view = "0";
         }
 
         const param_obj = post_params(req, meta.field_names);
@@ -38,7 +43,7 @@ const init_create_router = function (router, meta) {
             param_obj[meta.user_field] = user_id;
         }
 
-        const { code, err } = await entity.create_entity(param_obj);
+        const { code, err } = await entity.create_entity(param_obj, _view);
         if (!has_value(code)) {
             throw new Error("the method should return code");
         }

package/router/delete.js

@@ -1,7 +1,7 @@
 const { required_post_params } = require('../http/params');
 const { has_value } = require('../core/validate');
 const { NO_PARAMS, NO_RIGHTS } = require('../http/code');
-const { check_user_role } = require('../http/session');
+const { check_user_role } = require('../core/role');
 const { wrap_http } = require('../http/error');
 const { Entity } = require('../db/entity');
 
@@ -14,12 +14,10 @@ const init_delete_router = function (router, meta) {
     const entity = new Entity(meta);
 
     router.post('/delete', wrap_http(async function (req, res) {
-        if (meta.roles) {
-            const has_right = check_user_role(req, meta.roles, "d");
-            if (!has_right) {
-                res.json({ code: NO_RIGHTS, err: "no rights error" });
-                return;
-            }
+        const has_right = check_user_role(req, meta, "d");
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
         }
 
         const params = required_post_params(req, ["ids"]);

package/router/read.js

@@ -1,7 +1,8 @@
 const { required_post_params, get_params } = require('../http/params');
 const { has_value } = require('../core/validate');
 const { NO_PARAMS, SUCCESS, NO_RIGHTS } = require('../http/code');
-const { get_session_userid, get_session_user_groups, check_user_role, get_user_role_mode } = require('../http/session');
+const { check_user_role, get_user_role_mode } = require('../core/role');
+const { get_session_userid, get_session_user_groups } = require('../http/session');
 const { wrap_http } = require('../http/error');
 const { Entity } = require('../db/entity');
 
@@ -14,12 +15,10 @@ const init_read_router = function (router, meta) {
     const entity = new Entity(meta);
 
     router.get('/meta', wrap_http(async function (req, res) {
-        if (meta.roles) {
-            const has_right = check_user_role(req, meta.roles, "r");
-            if (!has_right) {
-                res.json({ code: NO_RIGHTS, err: "no rights error" });
-                return;
-            }
+        const has_right = check_user_role(req, meta, "r");
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
         }
 
         const entity_meta = {
@@ -38,24 +37,20 @@ const init_read_router = function (router, meta) {
     }));
 
     router.get('/mode', wrap_http(async function (req, res) {
-        if (meta.roles) {
-            const has_right = check_user_role(req, meta.roles, "r");
-            if (!has_right) {
-                res.json({ code: NO_RIGHTS, err: "no rights error" });
-                return;
-            }
+        const has_right = check_user_role(req, meta, "r");
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
         }
 
-        res.json({ code: SUCCESS, data: get_user_role_mode(req, meta.roles) });
+        res.json({ code: SUCCESS, data: get_user_role_mode(req, meta) });
     }));
 
     router.get('/ref', wrap_http(async function (req, res) {
-        if (meta.roles) {
-            const has_right = check_user_role(req, meta.roles, "r");
-            if (!has_right) {
-                res.json({ code: NO_RIGHTS, err: "no rights error" });
-                return;
-            }
+        const has_right = check_user_role(req, meta, "r");
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
         }
 
         const { ref_by_entity } = get_params(req, ["ref_by_entity"]);
@@ -65,12 +60,10 @@ const init_read_router = function (router, meta) {
     }));
 
     router.post('/list', wrap_http(async function (req, res) {
-        if (meta.roles) {
-            const has_right = check_user_role(req, meta.roles, "r");
-            if (!has_right) {
-                res.json({ code: NO_RIGHTS, err: "no rights error" });
-                return;
-            }
+        const has_right = check_user_role(req, meta, "r");
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
         }
 
         const query_params = required_post_params(req, ["_query"]);
@@ -107,12 +100,10 @@ const init_read_router = function (router, meta) {
     }));
 
     router.post('/read_entity', wrap_http(async function (req, res) {
-        if (meta.roles) {
-            const has_right = check_user_role(req, meta.roles, "r");
-            if (!has_right) {
-                res.json({ code: NO_RIGHTS, err: "no rights error" });
-                return;
-            }
+        const has_right = check_user_role(req, meta, "r");
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
         }
 
         let params = required_post_params(req, ["_id", "attr_names"]);
@@ -130,12 +121,10 @@ const init_read_router = function (router, meta) {
     }));
 
     router.post('/read_property', wrap_http(async function (req, res) {
-        if (meta.roles) {
-            const has_right = check_user_role(req, meta.roles, "r");
-            if (!has_right) {
-                res.json({ code: NO_RIGHTS, err: "no rights error" });
-                return;
-            }
+        const has_right = check_user_role(req, meta, "r");
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
         }
 
         let params = required_post_params(req, ["_id", "attr_names"]);

package/router/update.js

@@ -1,5 +1,5 @@
 const { set_file_fields, save_file_fields_to_db } = require('../db/gridfs');
-const { required_post_params, post_update_params } = require('../http/params');
+const { required_post_params, post_update_params, post_params } = require('../http/params');
 const { SUCCESS, NO_PARAMS, NO_RIGHTS } = require('../http/code');
 const { check_user_role } = require('../http/session');
 const { has_value } = require('../core/validate');
@@ -36,10 +36,16 @@ const init_update_router = function (router, meta) {
             }
         }
 
+        //which view to update the entity
+        let { _view } = post_params(req, ["_view"]);
+        if (!_view) {
+            _view = "0";
+        }
+
         const param_obj = post_update_params(req, meta.field_names);
         set_file_fields(meta, req, param_obj);
 
-        const { code, err } = await entity.update_entity(params["_id"], param_obj);
+        const { code, err } = await entity.update_entity(params["_id"], param_obj, _view);
         if (!has_value(code)) {
             throw new Error("the method should return code");
         }

package/setting.js

@@ -43,26 +43,4 @@ const get_settings = () => {
     return settings;
 }
 
-const is_valid_role = (role_name) => {
-    //no role defined, then no role check
-    if (!settings.roles) {
-        return true;
-    }
-    const roles = settings.roles.filter(role => role.name == role_name);
-    return roles.length == 1;
-}
-
-const is_root_role = (role_name) => {
-    //no role defined, then every one is root
-    if (!settings.roles) {
-        return true;
-    }
-
-    if (!is_valid_role(role_name)) {
-        return false;
-    }
-
-    return settings.roles.filter(role => role.name == role_name)[0].root == true;
-}
-
-module.exports = { init_settings, get_settings, is_root_role, is_valid_role };
+module.exports = { init_settings, get_settings };