jxp 4.0.0 → 4.1.1

package/dist/libs/jxp.js

@@ -8,6 +8,8 @@ const login = require("./login");
 const groups = require("./groups");
 const setup = require("./setup");
 const Docs = require("./docs");
+const docsAuth = require("./docs-auth");
+const loginRateLimit = require("./login_rate_limit");
 const querystring = require("node:querystring");
 const fs = require("fs");
 const morgan = require("morgan");
@@ -25,6 +27,7 @@ const call_guard = require("./call_guard");
 const response_sanitize = require("./response_sanitize");
 const link_index = require("./link_index");
 const { safeErrorMessage } = require("./safe_error");
+const { logRequestError, logAndThrow } = require("./request_log");
 const schemaModule = require("./schema");
 global.JXPSchema = schemaModule.default || schemaModule;
 var models = {};
@@ -37,10 +40,12 @@ function getStripFields(req) {
 function getSecurityOpts(req) {
     return req.config?.security || {};
 }
-function advancedQueryAllowed(Model, kind) {
+function advancedQueryAllowed(Model, kind, options) {
     const opts = Model.schema.opts;
     const aq = opts?.advanced_queries;
     if (kind === "bulkwrite") {
+        if (options?.isAdmin)
+            return true;
         return aq?.bulkwrite === true;
     }
     if (kind === "aggregate") {
@@ -48,13 +53,33 @@ function advancedQueryAllowed(Model, kind) {
     }
     return aq?.query !== false;
 }
+const middlewareBulkWriteAllowed = (req, res, next) => {
+    if (!advancedQueryAllowed(req.Model, "bulkwrite", { isAdmin: !!res.user?.admin })) {
+        const err = new errors.ForbiddenError(`POST /bulkwrite is disabled for model ${req.modelname}`);
+        logRequestError(req, res, err, "bulkwrite disabled");
+        return next(err);
+    }
+    next();
+};
+const middlewareAdvancedQueryAllowed = (kind) => {
+    return (req, res, next) => {
+        if (!advancedQueryAllowed(req.Model, kind)) {
+            const err = new errors.ForbiddenError(`POST /${kind} is disabled for model ${req.modelname}`);
+            logRequestError(req, res, err, `${kind} disabled`);
+            return next(err);
+        }
+        next();
+    };
+};
 // Middleware
 const middlewareModel = (req, res, next) => {
     const modelname = req.params.modelname;
     req.modelname = modelname;
     req.Model = models[modelname];
     if (!req.Model) {
-        throw new errors.NotFoundError(`Model ${modelname} not found`);
+        const err = new errors.NotFoundError(`Model ${modelname} not found`);
+        logRequestError(req, res, err, "model");
+        return next(err);
     }
     return next();
 };
@@ -62,7 +87,9 @@ const middlewarePasswords = (req, res, next) => {
     if (req.body && req.body.password) {
         if (req.query.password_override) {
             if (!res.user?.admin) {
-                throw new errors.ForbiddenError("password_override requires admin");
+                const err = new errors.ForbiddenError("password_override requires admin");
+                logRequestError(req, res, err, "password_override");
+                return next(err);
             }
         }
         else {
@@ -94,7 +121,7 @@ const outputJSON = async (req, res) => {
         res.send(res.result);
     }
     catch (err) {
-        console.error(new Date(), err);
+        logRequestError(req, res, err, "outputJSON");
         throw new errors.InternalServerError(safeErrorMessage(err));
     }
 };
@@ -118,7 +145,7 @@ const outputCSV = (req, res, next) => {
         next();
     }
     catch (err) {
-        console.error(err);
+        logRequestError(req, res, err, "outputCSV");
         throw new errors.InternalServerError(safeErrorMessage(err));
     }
 };
@@ -132,8 +159,7 @@ const actionGet = async (req, res) => {
         filters = query_sanitize.sanitizeFilter(filters, getSecurityOpts(req));
     }
     catch (err) {
-        console.trace(new Date(), err);
-        // Preserve BadRequestError, convert others to InternalServerError
+        logRequestError(req, res, err, "filter");
         if (err instanceof errors.BadRequestError) {
             throw err;
         }
@@ -179,7 +205,7 @@ const actionGet = async (req, res) => {
         if (count >= 0) {
             result.count = count;
         }
-        const effectiveLimit = query_limits.enforceListLimit(req, estimatedCount);
+        const effectiveLimit = query_limits.enforceListLimit(req, estimatedCount, res);
         query_limits.applyListPagination(q, result, req, effectiveLimit, count >= 0 ? count : 0, changeUrlParams);
         if (req.query.sort) {
             q.sort(req.query.sort);
@@ -224,10 +250,12 @@ const actionGet = async (req, res) => {
             console.timeEnd(opname);
     }
     catch (err) {
-        console.error(new Date(), err);
         if (debug)
             console.timeEnd(opname);
-        // Preserve BadRequestError, convert others to InternalServerError
+        if (!(err instanceof errors.BadRequestError) &&
+            !(err instanceof errors.ForbiddenError)) {
+            logRequestError(req, res, err, "get");
+        }
         if (err instanceof errors.BadRequestError) {
             throw err;
         }
@@ -249,7 +277,7 @@ const actionGetOne = async (req, res) => {
             console.timeEnd(opname);
     }
     catch (err) {
-        console.error(new Date(), err);
+        logRequestError(req, res, err, "getOne");
         if (debug)
             console.timeEnd(opname);
         if (err.code)
@@ -284,7 +312,7 @@ const actionPost = async (req, res) => {
             console.timeEnd(opname);
     }
     catch (err) {
-        console.error(new Date(), err);
+        logRequestError(req, res, err, "post");
         if (debug)
             console.timeEnd(opname);
         if (err.code)
@@ -298,8 +326,7 @@ const actionPut = async (req, res) => {
     try {
         let item = await req.Model.findById(req.params.item_id);
         if (!item) {
-            console.error(new Date(), "Document not found");
-            throw new errors.NotFoundError(`Document ${req.params.item_id} not found on ${req.modelname}`);
+            logAndThrow(req, res, new errors.NotFoundError(`Document ${req.params.item_id} not found on ${req.modelname}`), "put");
         }
         _populateItem(item, datamunging.deserialize(req.body));
         _versionItem(item);
@@ -324,7 +351,7 @@ const actionPut = async (req, res) => {
             console.timeEnd(opname);
     }
     catch (err) {
-        console.error(new Date(), err);
+        logRequestError(req, res, err, "put");
         if (debug)
             console.timeEnd(opname);
         if (err.code)
@@ -364,7 +391,7 @@ const actionUpdate = async (req, res) => {
             console.timeEnd(opname);
     }
     catch (err) {
-        console.error(new Date(), err);
+        logRequestError(req, res, err, "update");
         if (debug)
             console.timeEnd(opname);
         if (err.code)
@@ -398,7 +425,7 @@ const actionDelete = async (req, res) => {
                     }
                 }
                 else {
-                    throw new errors.ConflictError(`Parent link item exists in ${linked_model.modelname}/${linked_model.field}`);
+                    logAndThrow(req, res, new errors.ConflictError(`Parent link item exists in ${linked_model.modelname}/${linked_model.field}`), "delete");
                 }
             }
         });
@@ -427,7 +454,9 @@ const actionDelete = async (req, res) => {
             console.timeEnd(opname);
     }
     catch (err) {
-        console.error(new Date(), err);
+        if (!(err instanceof errors.ConflictError)) {
+            logRequestError(req, res, err, "delete");
+        }
         if (debug)
             console.timeEnd(opname);
         if (err.code)
@@ -444,7 +473,7 @@ const actionCount = async (req, res) => {
         filters = query_sanitize.sanitizeFilter(filters, getSecurityOpts(req));
     }
     catch (err) {
-        console.trace(new Date(), err);
+        logRequestError(req, res, err, "filter");
         if (err instanceof errors.BadRequestError || err instanceof errors.ForbiddenError) {
             throw err;
         }
@@ -464,7 +493,7 @@ const actionCount = async (req, res) => {
             console.timeEnd(opname);
     }
     catch (err) {
-        console.error(new Date(), err);
+        logRequestError(req, res, err, "count");
         if (debug)
             console.timeEnd(opname);
         if (err.code)
@@ -481,7 +510,7 @@ const actionCall = async (req, res) => {
         res.json(result);
     }
     catch (err) {
-        console.error(new Date(), err);
+        logRequestError(req, res, err, "call");
         if (err.code)
             throw err;
         if (err instanceof errors.ForbiddenError || err instanceof errors.NotFoundError) {
@@ -506,7 +535,7 @@ const actionCallItem = async (req, res) => {
         res.json(result);
     }
     catch (err) {
-        console.trace(err);
+        logRequestError(req, res, err, "call");
         if (err.code)
             throw err;
         if (err instanceof errors.ForbiddenError || err instanceof errors.NotFoundError) {
@@ -517,15 +546,22 @@ const actionCallItem = async (req, res) => {
 };
 // Actions (verbs)
 const actionQuery = async (req, res) => {
-    if (!advancedQueryAllowed(req.Model, "query")) {
-        throw new errors.ForbiddenError(`POST /query is disabled for model ${req.modelname}`);
-    }
     if (!req.body || !req.body.query || typeof req.body.query !== "object") {
-        throw new errors.BadRequestError("Query missing or not of type object");
+        logAndThrow(req, res, new errors.BadRequestError("Query missing or not of type object"), "query");
     }
     const opname = `query ${req.modelname} ${ops++}`;
     console.time(opname);
-    const sanitizedQuery = query_sanitize.sanitizeFilter(req.body.query, getSecurityOpts(req));
+    let sanitizedQuery;
+    try {
+        sanitizedQuery = query_sanitize.sanitizeFilter(req.body.query, getSecurityOpts(req));
+    }
+    catch (err) {
+        logRequestError(req, res, err, "query_sanitize");
+        if (err instanceof errors.BadRequestError || err instanceof errors.ForbiddenError) {
+            throw err;
+        }
+        throw new errors.InternalServerError(safeErrorMessage(err));
+    }
     let query = [sanitizedQuery];
     let checkDeleted = { "$or": [{ _deleted: false }, { _deleted: null }] };
     if (!req.query.showDeleted) {
@@ -543,7 +579,7 @@ const actionQuery = async (req, res) => {
             result.count = count;
         }
         const estimatedCount = await req.Model.estimatedDocumentCount();
-        const effectiveLimit = query_limits.enforceListLimit(req, estimatedCount);
+        const effectiveLimit = query_limits.enforceListLimit(req, estimatedCount, res);
         query_limits.applyListPagination(q, result, req, effectiveLimit, count >= 0 ? count : 0, changeUrlParams);
         if (req.query.sort) {
             q.sort(req.query.sort);
@@ -585,9 +621,12 @@ const actionQuery = async (req, res) => {
         res.json(result);
     }
     catch (err) {
-        console.error(new Date(), err);
         if (debug)
             console.timeEnd(opname);
+        if (!(err instanceof errors.BadRequestError) &&
+            !(err instanceof errors.ForbiddenError)) {
+            logRequestError(req, res, err, "query");
+        }
         if (err instanceof errors.BadRequestError || err instanceof errors.ForbiddenError) {
             throw err;
         }
@@ -598,19 +637,24 @@ const actionQuery = async (req, res) => {
 };
 // Actions (verbs)
 const actionAggregate = async (req, res) => {
-    if (!advancedQueryAllowed(req.Model, "aggregate")) {
-        throw new errors.ForbiddenError(`POST /aggregate is disabled for model ${req.modelname}`);
-    }
-    let query = (req.body.query) ? req.body.query : req.body; // Don't require to embed in query anymore
+    let query = req.body?.query ? req.body.query : req.body;
     if (!query || !Array.isArray(query)) {
-        console.error("query missing or not of type array");
-        throw new errors.BadRequestError("Query missing or not of type array");
+        logAndThrow(req, res, new errors.BadRequestError("Query missing or not of type array"), "aggregate");
     }
     query = query_manipulation.fix_query(query);
-    aggregate_guard.validatePipeline(query, {
-        aggregate_stages_allow: getSecurityOpts(req).aggregate_stages_allow,
-        isAdmin: res.user?.admin,
-    });
+    try {
+        aggregate_guard.validatePipeline(query, {
+            aggregate_stages_allow: getSecurityOpts(req).aggregate_stages_allow,
+            isAdmin: res.user?.admin,
+        });
+    }
+    catch (err) {
+        logRequestError(req, res, err, "aggregate_guard");
+        if (err instanceof errors.BadRequestError || err instanceof errors.ForbiddenError) {
+            throw err;
+        }
+        throw new errors.InternalServerError(safeErrorMessage(err));
+    }
     const opname = `aggregate ${req.modelname} ${ops++}`;
     console.time(opname);
     try {
@@ -628,9 +672,12 @@ const actionAggregate = async (req, res) => {
         res.json(result);
     }
     catch (err) {
-        console.error(new Date(), err);
         if (debug)
             console.timeEnd(opname);
+        if (!(err instanceof errors.BadRequestError) &&
+            !(err instanceof errors.ForbiddenError)) {
+            logRequestError(req, res, err, "aggregate");
+        }
         if (err instanceof errors.BadRequestError || err instanceof errors.ForbiddenError) {
             throw err;
         }
@@ -639,12 +686,10 @@ const actionAggregate = async (req, res) => {
 };
 // Actions (verbs)
 const actionBulkWrite = async (req, res) => {
-    if (!advancedQueryAllowed(req.Model, "bulkwrite")) {
-        throw new errors.ForbiddenError(`POST /bulkwrite is disabled for model ${req.modelname}`);
-    }
     if (!req.body || !Array.isArray(req.body)) {
-        console.error("query missing or not of type array");
-        throw new errors.BadRequestError("Query missing or not of type array");
+        const err = new errors.BadRequestError("Query missing or not of type array");
+        logRequestError(req, res, err, "bulkwrite");
+        throw err;
     }
     const opname = `bulkwrite ${req.modelname} ${ops++}`;
     console.time(opname);
@@ -662,7 +707,7 @@ const actionBulkWrite = async (req, res) => {
         res.json(result);
     }
     catch (err) {
-        console.error(new Date(), err);
+        logRequestError(req, res, err, "bulkwrite");
         if (debug)
             console.timeEnd(opname);
         if (err instanceof errors.BadRequestError || err instanceof errors.ForbiddenError) {
@@ -734,7 +779,6 @@ const getOne = async (Model, item_id, params, options) => {
         return response_sanitize.sanitizeDocument(item);
     }
     catch (err) {
-        console.error(err);
         if (err.code)
             throw err;
         throw new errors.InternalServerError(safeErrorMessage(err));
@@ -1053,6 +1097,10 @@ const JXP = function (options) {
     ws.init({ models });
     cache.init(config);
     const docs = new Docs({ config, models });
+    docsAuth.init(config);
+    docsAuth.logDocsAccessMode(config);
+    const loginThrottle = loginRateLimit.createLoginThrottle(config);
+    loginRateLimit.logLoginRateLimit(config);
     // Set up our API server
     // Rate limitting
     if (config.throttle) {
@@ -1108,9 +1156,9 @@ const JXP = function (options) {
     // CSV endpoints
     server.get("/csv/:modelname", middlewareModel, security.login, security.auth, config.pre_hooks.get, actionGet, outputCSV);
     // Query endpoints
-    server.post("/query/:modelname", middlewareModel, security.login, security.auth, config.pre_hooks.get, actionQuery);
-    server.post("/aggregate/:modelname", middlewareModel, security.login, security.auth, config.pre_hooks.get, actionAggregate);
-    server.post("/bulkwrite/:modelname", middlewareModel, security.login, security.bulkAuth, config.pre_hooks.get, actionBulkWrite);
+    server.post("/query/:modelname", middlewareModel, security.login, security.auth, middlewareAdvancedQueryAllowed("query"), config.pre_hooks.get, actionQuery);
+    server.post("/aggregate/:modelname", middlewareModel, security.login, security.auth, middlewareAdvancedQueryAllowed("aggregate"), config.pre_hooks.get, actionAggregate);
+    server.post("/bulkwrite/:modelname", middlewareModel, security.login, middlewareBulkWriteAllowed, security.bulkAuth, config.pre_hooks.get, actionBulkWrite);
     server.post("/update/:modelname/:item_id", middlewareModel, security.login, security.auth, middlewarePasswords, middlewareCheckAdmin, config.pre_hooks.update, actionUpdate, cache.clearAll);
     /* Batch routes - ROLLED BACK FOR NOW */
     // server.post('/batch/create/:modelname', middlewareModel, security.login, security.auth, actionBatch);
@@ -1125,7 +1173,14 @@ const JXP = function (options) {
     server.get("/logout", security.login, login.logout);
     server.get("/login/oauth/:provider", login.oauth);
     server.get("/login/oauth/callback/:provider", login.oauth_callback);
-    server.post("/login", config.pre_hooks.login, login.login, config.post_hooks.login, outputJSON);
+    const loginChain = [
+        ...(loginThrottle ? [loginThrottle] : []),
+        config.pre_hooks.login,
+        login.login,
+        config.post_hooks.login,
+        outputJSON,
+    ];
+    server.post("/login", ...loginChain);
     server.post("/refresh", security.refresh);
     server.post("/login/refresh", security.refresh);
     /* Groups */
@@ -1137,10 +1192,16 @@ const JXP = function (options) {
     server.get("/model/:modelname", middlewareModel, docs.metaModel.bind(docs));
     server.get("/model", docs.metaModels.bind(docs));
     // server.get("/docs/_design", docs.dbDiagram.bind(docs));
+    server.get("/docs/login", async (req, res) => {
+        await docsAuth.loginPage(req, res, docs.renderLogin.bind(docs));
+    });
+    server.post("/docs/session", ...(loginThrottle ? [loginThrottle] : []), docsAuth.establishSession);
+    server.get("/docs/session", docsAuth.getSession);
+    server.post("/docs/logout", docsAuth.logout);
     server.get("/docs/assets/:file", docs.serveAsset.bind(docs));
-    server.get("/docs/api", docs.apiIndex.bind(docs));
+    server.get("/docs/api", docsAuth.docsAccessMiddleware, docs.apiIndex.bind(docs));
     server.get("/docs/md/:md_doc", docs.md.bind(docs));
-    server.get("/docs/model/:modelname", docs.model.bind(docs));
+    server.get("/docs/model/:modelname", docsAuth.docsAccessMiddleware, docs.model.bind(docs));
     server.get("/", docs.frontPage.bind(docs));
     /* Setup */
     server.get("/setup", setup.checkUserDoesNotExist, setup.setup);
@@ -1148,6 +1209,10 @@ const JXP = function (options) {
     server.post("/setup/data", setup.checkUserDoesNotExist, setup.data_setup);
     /* Websocket */
     server.on("upgrade", ws.upgrade);
+    server.on("restError", (req, res, err, callback) => {
+        logRequestError(req, res, err);
+        return callback();
+    });
     /* Cache */
     server.get("/cache/stats", security.login, security.admin_only, cache.stats, outputJSON);
     server.get("/cache/clear", security.login, security.admin_only, cache.clearAll, outputJSON);