hola-server 1.0.6 → 1.0.8

package/core/meta.js

@@ -251,6 +251,7 @@ class EntityMeta {
         this.field_names = this.fields.map(field => field.name);
         this.user_field = meta.user_field;
 
+        this.client_fields = this.fields.filter(field => field.sys != true);
         this.property_fields = this.fields.filter(field => field.sys != true && field.secure != true);
         this.create_fields = this.fields.filter(field => field.create != false && field.sys != true);
         this.update_fields = this.fields.filter(field => field.create != false && field.update != false && field.sys != true);

package/core/role.js

@@ -44,22 +44,30 @@ const get_session_user_role = (req) => {
     return user ? user.role : null;
 }
 
+/**
+ * 
+ * @param {*} req 
+ */
+const is_root_user = (req) => {
+    return is_root_role(get_session_user_role(req));
+}
+
 /**
  * Get the meta mode based on user's role
  * @param {request} req 
  * @param {meta} meta 
  * @returns 
  */
-const get_user_role_mode = (req, meta) => {
+const get_user_role_right = (req, meta) => {
     const settings = get_settings();
     //no role defined in settings or no roles defined in meta, use meta mode
     if (!settings.roles || !meta.roles) {
-        return meta.mode;
+        return [meta.mode, "*"];
     }
 
     const user_role = get_session_user_role(req);
     if (!user_role) {
-        return "";
+        return ["", ""];
     }
 
     if (is_valid_role(user_role)) {
@@ -69,17 +77,18 @@ const get_user_role_mode = (req, meta) => {
             const role_settings = role.split(":");
             const role_name = role_settings[0];
             const role_mode = role_settings[1];
+            const role_view = role_settings.length == 3 ? role_settings[2] : "*";
             if (user_role == role_name) {
                 // * stands to get the mode from meta definition
                 if (role_mode == "*") {
-                    return meta.mode;
+                    return [meta.mode, role_view];
                 } else {
-                    return role_mode;
+                    return [role_mode, role_view];
                 }
             }
         }
     }
-    return "";
+    return ["", ""];
 }
 
 /**
@@ -87,11 +96,12 @@ const get_user_role_mode = (req, meta) => {
  * @param {http request} req 
  * @param {meta defination} meta 
  * @param {meta mode} mode 
+ * @param {view} view
  * @returns 
  */
-const check_user_role = (req, meta, mode) => {
-    const role_mode = get_user_role_mode(req, meta);
-    return role_mode.includes(mode);
+const check_user_role = (req, meta, mode, view) => {
+    const [role_mode, role_view] = get_user_role_right(req, meta);
+    return role_mode.includes(mode) && (role_view == "*" || role_view.includes(view));
 }
 
-module.exports = { is_root_role, validate_meta_role, check_user_role, get_user_role_mode };
+module.exports = { is_root_role, is_root_user, validate_meta_role, check_user_role, get_user_role_right };

package/db/entity.js

@@ -188,7 +188,7 @@ class Entity {
      * @param {search object and all the search attributes object} param_obj 
      * @returns 
      */
-    async list_entity(query_params, query, param_obj) {
+    async list_entity(query_params, query, param_obj, view) {
         const error_required_field_names = validate_required_fields(query_params, ["attr_names", "sort_by", "desc"]);
         if (error_required_field_names.length > 0) {
             if (is_log_error()) {
@@ -206,7 +206,9 @@ class Entity {
             sort[value] = descs[index] === "false" ? 1 : -1;
         });
 
-        const list_field_names = this.meta.list_fields.map(f => f.name);
+        const list_fields = view && view !== "*" ? this.meta.list_fields.filter(field => Array.isArray(field.view) ? this.contain_view(field.view, view) || field.view.includes("*") : view.includes(field.view) || field.view === "*") : this.meta.list_fields;
+        const list_field_names = list_fields.map(f => f.name);
+
         const ref_fields = [];
         const link_fields = [];
 
@@ -337,8 +339,8 @@ class Entity {
     * @param {param obj from user input} param_obj
     * @returns object with code and err
     */
-    async clone_entity(_id, param_obj) {
-        const fields = this.meta.clone_fields
+    async clone_entity(_id, param_obj, view) {
+        const fields = view && view !== "*" ? this.meta.clone_fields.filter(field => Array.isArray(field.view) ? field.view.includes(view) || field.view.includes("*") : field.view === view || field.view === "*") : this.meta.clone_fields;
         const { obj, error_field_names } = convert_type(param_obj, fields);
         if (error_field_names.length > 0) {
             if (is_log_error()) {
@@ -504,8 +506,9 @@ class Entity {
      * @param {param object from user input} param_obj 
      * 
      */
-    async batch_update_entity(_ids, param_obj) {
-        const { obj, error_field_names } = convert_update_type(param_obj, this.meta.update_fields);
+    async batch_update_entity(_ids, param_obj, view) {
+        const update_fields = view && view !== "*" ? this.meta.update_fields.filter(field => Array.isArray(field.view) ? this.contain_view(field.view, view) || field.view.includes("*") : view.includes(field.view) || field.view === "*") : this.meta.update_fields;
+        const { obj, error_field_names } = convert_update_type(param_obj, update_fields);
         if (error_field_names.length > 0) {
             if (is_log_error()) {
                 log_error(LOG_ENTITY, "batch_update_entity error fields:" + JSON.stringify(error_field_names));
@@ -562,6 +565,15 @@ class Entity {
         return { code: SUCCESS };
     }
 
+    contain_view(array, view) {
+        for (let i = 0; i < array.length; i++) {
+            if (view.includes(array[i])) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     /**
      * Use objectid to read entity properties. Validate the param object and invoke the logic to read entity properties.
      * This method doesn't convert ref property, so all the ref properties are objectid of the ref entity.
@@ -570,7 +582,7 @@ class Entity {
      * @param {attr names to retrieve} attr_names
      *
      */
-    async read_property(_id, attr_names) {
+    async read_property(_id, attr_names, view) {
         const query = oid_query(_id);
         if (query == null) {
             if (is_log_error()) {
@@ -579,7 +591,8 @@ class Entity {
             return { code: INVALID_PARAMS, err: ["_id"] };
         }
 
-        const field_names = this.meta.property_fields.map(f => f.name);
+        const property_fields = view && view !== "*" ? this.meta.property_fields.filter(field => Array.isArray(field.view) ? this.contain_view(field.view, view) || field.view.includes("*") : view.includes(field.view) || field.view === "*") : this.meta.property_fields;
+        const field_names = property_fields.map(f => f.name);
         const attrs = { _id: 1 };
         attr_names.split(",").forEach((attr) => {
             if (field_names.includes(attr)) {
@@ -605,7 +618,7 @@ class Entity {
      * @param {attr names to retrieve} attr_names
      *
      */
-    async read_entity(_id, attr_names) {
+    async read_entity(_id, attr_names, view) {
         const query = oid_query(_id);
         if (query == null) {
             if (is_log_error()) {
@@ -621,7 +634,9 @@ class Entity {
             return { code: INVALID_PARAMS, err: ["attr_names"] };
         }
 
-        const field_names = this.meta.property_fields.map(f => f.name);
+        const property_fields = view && view !== "*" ? this.meta.property_fields.filter(field => Array.isArray(field.view) ? this.contain_view(field.view, view) || field.view.includes("*") : view.includes(field.view) || field.view === "*") : this.meta.property_fields;
+        const field_names = property_fields.map(f => f.name);
+
         const ref_fields = [];
         const link_fields = [];
         const attrs = { _id: 1 };

package/http/session.js

@@ -1,6 +1,7 @@
 const express_session = require('express-session');
 const MongoStore = require('connect-mongo');
 const { get_settings } = require('../setting');
+const { is_root_user } = require('../core/role');
 
 const init_session = (app) => {
     const server = get_settings().server;
@@ -29,4 +30,21 @@ const get_session_user_groups = (req) => {
     return group && Array.isArray(group) ? group : null;
 }
 
-module.exports = { init_session, get_session_userid, get_session_user_groups };
+const is_owner = async (req, meta, entity, query) => {
+    if (is_root_user(req)) {
+        return true;
+    }
+
+    if (meta.user_field) {
+        const user_id = get_session_userid(req);
+        if (user_id == null) {
+            throw new Error("no user id is found in session");
+        }
+        const user_query = {};
+        user_query[meta.user_field] = user_id;
+        return await entity.count({ ...query, ...user_query }) == 1;
+    }
+    return true;
+}
+
+module.exports = { init_session, get_session_userid, get_session_user_groups, is_owner };

package/index.js

@@ -5,7 +5,7 @@ const { init_router } = require('./http/router');
 const { init_express_server } = require('./http/express');
 const { register_type, get_type } = require('./core/type');
 const { EntityMeta, get_entity_meta } = require('./core/meta');
-const { is_root_role } = require('./core/role');
+const { is_root_role, is_root_user, check_user_role, get_user_role_right } = require('./core/role');
 const { url } = require('./core/url');
 const array = require('./core/array');
 const bash = require('./core/bash');
@@ -30,7 +30,7 @@ const { gen_i18n } = require('./tool/gen_i18n');
 const { log_debug, log_info, log_warn, log_error, is_log_debug, is_log_info, is_log_warn, is_log_error, get_session_userid, oid_queries, oid_query } = require('./db/db');
 
 module.exports = {
-    init_settings, is_root_role, init_express_server, init_router, register_type, get_type, get_db, url,
+    init_settings, is_root_role, is_root_user, check_user_role, get_user_role_right, init_express_server, init_router, register_type, get_type, get_db, url,
     Entity, EntityMeta, get_entity_meta, array, bash, chart, cron, date, file, lhs, msg, number, obj, random, thread, validate, code, err, params, context, gridfs, gen_i18n,
     log_debug, log_info, log_warn, log_error, is_log_debug, is_log_info, is_log_warn, is_log_error, get_session_userid, oid_queries, oid_query
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hola-server",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "a meta programming framework used to build nodejs restful api",
   "main": "index.js",
   "scripts": {

package/router/clone.js

@@ -1,10 +1,11 @@
 const { set_file_fields, save_file_fields_to_db } = require('../db/gridfs');
 const { SUCCESS, NO_PARAMS, NO_RIGHTS } = require('../http/code');
-const { get_session_userid } = require('../http/session');
+const { get_session_userid, is_owner } = require('../http/session');
 const { wrap_http } = require('../http/error');
 const { post_params, required_post_params } = require('../http/params');
 const { has_value } = require('../core/validate');
 const { check_user_role } = require('../core/role');
+const { oid_query } = require('../db/db');
 const { Entity } = require('../db/entity');
 
 const multer = require('multer');
@@ -20,7 +21,13 @@ const init_clone_router = function (router, meta) {
     const cp_upload = meta.upload_fields.length > 0 ? upload_file.fields(meta.upload_fields) : upload_file.none();
 
     router.post('/clone', cp_upload, wrap_http(async function (req, res) {
-        const has_right = check_user_role(req, meta, "o");
+        //which view to clone the entity
+        let { _view } = post_params(req, ["_view"]);
+        if (!_view) {
+            _view = "*";
+        }
+
+        const has_right = check_user_role(req, meta, "o", _view);
         if (!has_right) {
             res.json({ code: NO_RIGHTS, err: "no rights error" });
             return;
@@ -35,6 +42,13 @@ const init_clone_router = function (router, meta) {
         const param_obj = post_params(req, meta.field_names);
         set_file_fields(meta, req, param_obj);
 
+        const query = params["_id"] ? oid_query(params["_id"]) : entity.primary_key_query(param_obj);
+        const owner = await is_owner(req, meta, entity, query);
+        if (!owner) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
+        }
+
         if (meta.user_field) {
             const user_id = get_session_userid(req);
             if (user_id == null) {
@@ -43,7 +57,7 @@ const init_clone_router = function (router, meta) {
             param_obj[meta.user_field] = user_id;
         }
 
-        const { code, err } = await entity.clone_entity(params["_id"], param_obj);
+        const { code, err } = await entity.clone_entity(params["_id"], param_obj, _view);
         if (!has_value(code)) {
             throw new Error("the method should return code");
         }

package/router/create.js

@@ -20,18 +20,18 @@ const init_create_router = function (router, meta) {
     const cp_upload = meta.upload_fields.length > 0 ? upload_file.fields(meta.upload_fields) : upload_file.none();
 
     router.post('/create', cp_upload, wrap_http(async function (req, res) {
-        const has_right = check_user_role(req, meta, "c");
-        if (!has_right) {
-            res.json({ code: NO_RIGHTS, err: "no rights error" });
-            return;
-        }
-
         //which view to create the entity
         let { _view } = post_params(req, ["_view"]);
         if (!_view) {
             _view = "*";
         }
 
+        const has_right = check_user_role(req, meta, "c", _view);
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
+        }
+
         const param_obj = post_params(req, meta.field_names);
         set_file_fields(meta, req, param_obj);
 

package/router/delete.js

@@ -2,6 +2,8 @@ const { required_post_params } = require('../http/params');
 const { has_value } = require('../core/validate');
 const { NO_PARAMS, NO_RIGHTS } = require('../http/code');
 const { check_user_role } = require('../core/role');
+const { is_owner } = require('../http/session');
+const { oid_query } = require('../db/db');
 const { wrap_http } = require('../http/error');
 const { Entity } = require('../db/entity');
 
@@ -14,7 +16,7 @@ const init_delete_router = function (router, meta) {
     const entity = new Entity(meta);
 
     router.post('/delete', wrap_http(async function (req, res) {
-        const has_right = check_user_role(req, meta, "d");
+        const has_right = check_user_role(req, meta, "d", "*");
         if (!has_right) {
             res.json({ code: NO_RIGHTS, err: "no rights error" });
             return;
@@ -28,6 +30,16 @@ const init_delete_router = function (router, meta) {
 
         const { ids } = params;
         const id_array = ids.split(",");
+
+        for (let i = 0; i < id_array.length; i++) {
+            const id_query = oid_query(id_array[i]);
+            const owner = await is_owner(req, meta, entity, id_query);
+            if (!owner) {
+                res.json({ code: NO_RIGHTS, err: "no rights error" });
+                return;
+            }
+        }
+
         const { code, err } = await entity.delete_entity(id_array);
         if (!has_value(code)) {
             throw new Error("the delete_entity method should return code");

package/router/read.js

@@ -1,11 +1,21 @@
 const { required_post_params, get_params } = require('../http/params');
 const { has_value } = require('../core/validate');
 const { NO_PARAMS, SUCCESS, NO_RIGHTS } = require('../http/code');
-const { check_user_role, get_user_role_mode } = require('../core/role');
-const { get_session_userid, get_session_user_groups } = require('../http/session');
+const { check_user_role, get_user_role_right } = require('../core/role');
+const { get_session_userid, get_session_user_groups, is_owner } = require('../http/session');
 const { wrap_http } = require('../http/error');
+const { oid_query } = require('../db/db');
 const { Entity } = require('../db/entity');
 
+const contain_view = (array, view) => {
+    for (let i = 0; i < array.length; i++) {
+        if (view.includes(array[i])) {
+            return true;
+        }
+    }
+    return false;
+}
+
 /**
  * init http read router
  * @param {express router} router 
@@ -15,35 +25,37 @@ const init_read_router = function (router, meta) {
     const entity = new Entity(meta);
 
     router.get('/meta', wrap_http(async function (req, res) {
-        const has_right = check_user_role(req, meta, "r");
+        const [role_mode, role_view] = get_user_role_right(req, meta);
+        const has_right = role_mode.includes("r");
         if (!has_right) {
             res.json({ code: NO_RIGHTS, err: "no rights error" });
             return;
         }
 
+        const client_fields = role_view && role_view !== "*" ? meta.client_fields.filter(field => Array.isArray(field.view) ? contain_view(field.view, role_view) || field.view.includes("*") : role_view.includes(field.view) || field.view === "*") : meta.client_fields;
         const entity_meta = {
-            creatable: meta.creatable,
-            readable: meta.readable,
-            updatable: meta.updatable,
-            deleteable: meta.deleteable,
-            cloneable: meta.cloneable,
-            importable: meta.importable,
-            exportable: meta.exportable,
-            editable: meta.editable,
-            user_field: meta.user_field,
-            fields: meta.fields
+            creatable: role_mode.includes("c"),
+            readable: role_mode.includes("r"),
+            updatable: role_mode.includes("u"),
+            deleteable: role_mode.includes("d"),
+            cloneable: role_mode.includes("o"),
+            importable: role_mode.includes("i"),
+            exportable: role_mode.includes("e"),
+            editable: role_mode.includes("c") || role_mode.includes("u"),
+            fields: client_fields
         }
         res.json({ code: SUCCESS, data: entity_meta });
     }));
 
     router.get('/mode', wrap_http(async function (req, res) {
-        const has_right = check_user_role(req, meta, "r");
+        const has_right = check_user_role(req, meta, "r", "*");
         if (!has_right) {
             res.json({ code: NO_RIGHTS, err: "no rights error" });
             return;
         }
 
-        res.json({ code: SUCCESS, data: get_user_role_mode(req, meta) });
+        const [mode, view] = get_user_role_right(req, meta);
+        res.json({ code: SUCCESS, mode: mode, view: view });
     }));
 
     router.get('/ref', wrap_http(async function (req, res) {
@@ -60,7 +72,8 @@ const init_read_router = function (router, meta) {
     }));
 
     router.post('/list', wrap_http(async function (req, res) {
-        const has_right = check_user_role(req, meta, "r");
+        const [role_mode, role_view] = get_user_role_right(req, meta);
+        const has_right = role_mode.includes("r");
         if (!has_right) {
             res.json({ code: NO_RIGHTS, err: "no rights error" });
             return;
@@ -92,7 +105,7 @@ const init_read_router = function (router, meta) {
         }
 
         const query = meta.list_query ? await meta.list_query(entity, param_obj, req) : null;
-        const { code, err, total, data } = await entity.list_entity(query_params["_query"], query, param_obj);
+        const { code, err, total, data } = await entity.list_entity(query_params["_query"], query, param_obj, role_view);
         if (!has_value(code)) {
             throw new Error("the list_entity method should return code");
         }
@@ -101,7 +114,8 @@ const init_read_router = function (router, meta) {
     }));
 
     router.post('/read_entity', wrap_http(async function (req, res) {
-        const has_right = check_user_role(req, meta, "r");
+        const [role_mode, role_view] = get_user_role_right(req, meta);
+        const has_right = role_mode.includes("r");
         if (!has_right) {
             res.json({ code: NO_RIGHTS, err: "no rights error" });
             return;
@@ -114,7 +128,14 @@ const init_read_router = function (router, meta) {
         }
 
         const { _id, attr_names } = params;
-        const { code, err, data } = await entity.read_entity(_id, attr_names);
+
+        const owner = await is_owner(req, meta, entity, oid_query(_id));
+        if (!owner) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
+        }
+
+        const { code, err, data } = await entity.read_entity(_id, attr_names, role_view);
         if (!has_value(code)) {
             throw new Error("the method should return code");
         }
@@ -122,7 +143,8 @@ const init_read_router = function (router, meta) {
     }));
 
     router.post('/read_property', wrap_http(async function (req, res) {
-        const has_right = check_user_role(req, meta, "r");
+        const [role_mode, role_view] = get_user_role_right(req, meta);
+        const has_right = role_mode.includes("r");
         if (!has_right) {
             res.json({ code: NO_RIGHTS, err: "no rights error" });
             return;
@@ -135,7 +157,14 @@ const init_read_router = function (router, meta) {
         }
 
         const { _id, attr_names } = params;
-        const { code, err, data } = await entity.read_property(_id, attr_names);
+
+        const owner = await is_owner(req, meta, entity, oid_query(_id));
+        if (!owner) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
+        }
+
+        const { code, err, data } = await entity.read_property(_id, attr_names, role_view);
         if (!has_value(code)) {
             throw new Error("the method should return code");
         }

package/router/update.js

@@ -1,8 +1,10 @@
 const { set_file_fields, save_file_fields_to_db } = require('../db/gridfs');
 const { required_post_params, post_update_params, post_params } = require('../http/params');
 const { SUCCESS, NO_PARAMS, NO_RIGHTS } = require('../http/code');
-const { check_user_role } = require('../core/role');
 const { has_value } = require('../core/validate');
+const { check_user_role, get_user_role_right } = require('../core/role');
+const { is_owner } = require('../http/session');
+const { oid_query } = require('../db/db');
 const { wrap_http } = require('../http/error');
 const { Entity } = require('../db/entity');
 
@@ -19,12 +21,16 @@ const init_update_router = function (router, meta) {
     const cp_upload = meta.upload_fields.length > 0 ? upload_file.fields(meta.upload_fields) : upload_file.none();
 
     router.post('/update', cp_upload, wrap_http(async function (req, res) {
-        if (meta.roles) {
-            const has_right = check_user_role(req, meta, "u");
-            if (!has_right) {
-                res.json({ code: NO_RIGHTS, err: "no rights error" });
-                return;
-            }
+        //which view to update the entity
+        let { _view } = post_params(req, ["_view"]);
+        if (!_view) {
+            _view = "*";
+        }
+
+        const has_right = check_user_role(req, meta, "u", _view);
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
         }
 
         let params = required_post_params(req, ["_id"]);
@@ -36,15 +42,16 @@ const init_update_router = function (router, meta) {
             }
         }
 
-        //which view to update the entity
-        let { _view } = post_params(req, ["_view"]);
-        if (!_view) {
-            _view = "*";
-        }
-
         const param_obj = post_update_params(req, meta.field_names);
         set_file_fields(meta, req, param_obj);
 
+        const query = params["_id"] ? oid_query(params["_id"]) : entity.primary_key_query(param_obj);
+        const owner = await is_owner(req, meta, entity, query);
+        if (!owner) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
+        }
+
         const { code, err } = await entity.update_entity(params["_id"], param_obj, _view);
         if (!has_value(code)) {
             throw new Error("the method should return code");
@@ -58,6 +65,13 @@ const init_update_router = function (router, meta) {
     }));
 
     router.post('/batch_update', cp_upload, wrap_http(async function (req, res) {
+        const [role_mode, role_view] = get_user_role_right(req, meta);
+        const has_right = role_mode.includes("u");
+        if (!has_right) {
+            res.json({ code: NO_RIGHTS, err: "no rights error" });
+            return;
+        }
+
         let params = required_post_params(req, ["_ids"]);
         if (params === null) {
             res.json({ code: NO_PARAMS, err: '[_ids] checking params are failed!' });
@@ -67,7 +81,17 @@ const init_update_router = function (router, meta) {
         const param_obj = post_update_params(req, meta.field_names);
         set_file_fields(meta, req, param_obj);
 
-        const { code, err } = await entity.batch_update_entity(params["_ids"], param_obj);
+        const ids = params["_ids"];
+        for (let i = 0; i < ids.length; i++) {
+            const id_query = oid_query(ids[i]);
+            const owner = await is_owner(req, meta, entity, id_query);
+            if (!owner) {
+                res.json({ code: NO_RIGHTS, err: "no rights error" });
+                return;
+            }
+        }
+
+        const { code, err } = await entity.batch_update_entity(ids, param_obj, role_view);
         if (!has_value(code)) {
             throw new Error("the batch_update_entity method should return code");
         }