nitro-web 0.0.82 → 0.0.84

package/client/app.tsx

@@ -291,9 +291,9 @@ async function beforeApp(config: Config) {
 
 const defaultMiddleware = {
   // Global middleware that can referenced from component routes
-  isAdmin: (route: unknown, store: { user?: { type?: string } }) => {
+  isAdmin: (route: unknown, store: { user?: { type?: string, isAdmin?: boolean } }) => {
     const user = store.user || { type: 'visitor' }
-    if (user?.type?.match(/admin/)) return
+    if (user?.type?.match(/admin/) || user?.isAdmin) return
     else if (user?.type && user?.type !== 'visitor') return { redirect: '/signin?unauth' }
     else return { redirect: '/signin?signin' }
   },

package/components/auth/auth.api.js

@@ -192,7 +192,7 @@ async function resetPassword(req, res) {
 async function inviteInstructions(req, res) {
   try {
     // Check if user is admin here rather than in middleware (which may not exist yet)
-    if (req.user.type != 'admin') {
+    if (req.user.type != 'admin' && !req.user.isAdmin) {
       throw new Error('You are not authorized to invite users.')
     }
     const inviteToken = await tokenCreate()

package/components/partials/element/filters.tsx

@@ -158,7 +158,7 @@ export const Filters = forwardRef<FiltersHandleType, FiltersProps>(({
                     <Elements.Field 
                       {...filter}
                       class="!mb-0"
-                      value={state[filter.name] as string || ''}
+                      value={(state[filter.name] as string) || ''}
                       onChange={onInputChange}
                     />
                   }

package/components/partials/form/drop.tsx

@@ -37,7 +37,7 @@ export function Drop({ awsUrl, className, id, name, onChange, multiple, state, .
   stateRef.current = state
 
   // Input is always controlled if state is passed in
-  if (props.value) value = props.value as Image
+  if (typeof props.value !== 'undefined') value = props.value as Image
   else if (typeof state == 'object') value = deepFind(state, name) as Image
   if (typeof value == 'undefined') value = null
 

package/components/partials/form/field.tsx

@@ -68,7 +68,7 @@ function FieldBase({ state, icon, iconPos: ip, ...props }: FieldProps) {
   })
   
   // Value: Input is always controlled if state is passed in
-  if (props.value) value = props.value as string
+  if (typeof props.value !== 'undefined') value = props.value as string
   else if (typeof state == 'object') {
     const v = deepFind(state, props.name) as string | undefined
     value = v ?? ''

package/components/partials/form/select.tsx

@@ -57,7 +57,7 @@ function SelectBase({ id, containerId, minMenuWidth, name, prefix='', onChange,
   if (!name) throw new Error('Select component requires a `name` and `options` prop')
 
   // Get value from value or state
-  if ('value' in props) value = props.value
+  if (typeof props.value !== 'undefined') value = props.value
   else if (typeof state == 'object') value = deepFind(state, name)
 
   // If multi-select, filter options by value

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nitro-web",
-  "version": "0.0.82",
+  "version": "0.0.84",
   "repository": "github:boycce/nitro-web",
   "homepage": "https://boycce.github.io/nitro-web/",
   "description": "Nitro is a battle-tested, modular base project to turbocharge your projects, styled using Tailwind 🚀",

package/server/router.js

@@ -298,8 +298,8 @@ function resolveMiddleware (controllers, middleware, route, item) {
 }
 
 export const middleware = {
+  // Default middleware called before all /api/* routes
   order: [
-    // Express middleware runtime order that are called for all API requests
     'loadAssets',
     'modifyRequest',
     'parseUrlEncoded',
@@ -308,6 +308,8 @@ export const middleware = {
     'beforeAPIRoute',
   ],
 
+  // --- Default middleware ---------------------
+
   modifyRequest: (req, res, next) => {
     // Handy boolean denoting that the request wants JSON returned
     // global.start = new Date().getTime()
@@ -345,4 +347,42 @@ export const middleware = {
     res.set('version', req.version)
     next()
   },
+
+  // --- Custom middleware ----------------------
+
+  isAdmin: (req, res, next) => {
+    // Still need to remove cookie matching in favour of uid..
+    // E.g. Cookie matching handy for rare issues, e.g. signout > signin (to a different user on another tab)
+    const user = req.user
+    let cookieMatch = user && (!req.headers.authid || user._id.toString() == req.headers.authid)
+    if (cookieMatch && (user.type?.match(/admin/) || user.isAdmin)) next()
+    else if (user && (user.type?.match(/admin/) || user.isAdmin)) res.unauthorized('Invalid cookie, please refresh your browser')
+    else if (user) res.unauthorized('You are not authorised to make this request.')
+    else res.unauthorized('Please sign in first.')
+  },
+  isCompanyOwner: (req, res, next) => {
+    let user = req.user || { companies: [] }
+    let cid = req.params.cid
+    let company = user.companies.find((o) => o._id.toString() == cid)
+    let companyUser = company?.users?.find((o) => o._id.toString() == user._id.toString())
+    if (!user._id) return res.unauthorized('Please sign in first.')
+    else if (!company || !companyUser) res.unauthorized('You are not authorised to make this request.')
+    else if (companyUser.type != 'owner') res.unauthorized('Only owners can make this request.')
+    else next()
+  },
+  isCompanyUser: (req, res, next) => {
+    let user = req.user || { companies: [] }
+    let cid = req.params.cid
+    let company = user.companies.find((o) => o._id.toString() == cid)
+    if (!user._id) return res.unauthorized('Please sign in first.')
+    else if (!company) res.unauthorized('You are not authorised to make this request.')
+    else next()
+  },
+  isUser: (req, res, next) => {
+    // todo: need to double check that uid is always defined
+    let uid = req.params.uid
+    if (req.user && (typeof uid == 'undefined' || req.user._id.toString() == uid)) next()
+    else if (req.user) res.unauthorized('You are not authorised to make this request.')
+    else res.unauthorized('Please sign in first.')
+  },
 }