not-node 6.3.0 → 6.3.2

package/test/init/sessions.js

@@ -14,9 +14,9 @@ module.exports = ({ expect }) => {
     describe("Sessions", () => {
         describe("getConstructor", () => {
             describe("getConstructor", () => {
-                it("driver mongo", () => {
+                it("driver mongoose", () => {
                     const res = InitSessions.getConstructor({
-                        driver: "mongo",
+                        driver: "mongoose",
                     });
                     expect(res.prototype.constructor.name).to.be.equal(
                         "InitSessionsMongo"
@@ -81,6 +81,18 @@ module.exports = ({ expect }) => {
                         expect(e).to.be.instanceof(Error);
                     }
                 });
+
+                it("no config", async () => {
+                    const fEmit = createFakeEmit();
+                    const config = {
+                        get() {
+                            return undefined;
+                        },
+                    };
+                    await new InitSessions().run({
+                        config,
+                    });
+                });
             });
 
             after(() => {

package/test/notManifestFilter.js

@@ -1,3 +1,10 @@
+const { notFieldsFilter } = require("..");
+const {
+    DEFAULT_USER_ROLE_FOR_GUEST,
+    ACTION_SIGNATURES,
+} = require("../src/auth");
+
+const Schema = require("mongoose").Schema;
 const expect = require("chai").expect,
     notManifestFilter = require("../src/manifest/manifest.filter");
 
@@ -163,7 +170,7 @@ describe("notManifestFilter", function () {
             const result = notManifestFilter.filterRoute(
                 route,
                 false,
-                "user",
+                ["user"],
                 false
             );
             expect(result).to.deep.equal({
@@ -179,7 +186,7 @@ describe("notManifestFilter", function () {
             const result = notManifestFilter.filterRoute(
                 route,
                 false,
-                "user",
+                ["user"],
                 true
             );
             expect(result).to.deep.equal({
@@ -198,7 +205,7 @@ describe("notManifestFilter", function () {
             const result = notManifestFilter.filterRoute(
                 route,
                 true,
-                "user",
+                ["user"],
                 false
             );
             expect(result).to.deep.equal({
@@ -214,7 +221,7 @@ describe("notManifestFilter", function () {
             const result = notManifestFilter.filterRoute(
                 route,
                 true,
-                "manager",
+                ["manager"],
                 false
             );
             expect(result).to.deep.equal({
@@ -347,20 +354,16 @@ describe("notManifestFilter", function () {
                 manAfterFilter = notManifestFilter.filter(
                     man,
                     false,
+                    [],
                     false,
-                    false
+                    ""
                 );
             expect(manAfterFilter).to.deep.equal(filtered.guest);
         });
 
         it("Auth manifest", function () {
             let man = rawRoutesManifest,
-                manAfterFilter = notManifestFilter.filter(
-                    man,
-                    true,
-                    false,
-                    false
-                );
+                manAfterFilter = notManifestFilter.filter(man, true, [], false);
             expect(manAfterFilter).to.deep.equal(filtered.user);
         });
 
@@ -369,7 +372,7 @@ describe("notManifestFilter", function () {
                 manAfterFilter = notManifestFilter.filter(
                     man,
                     true,
-                    "manager",
+                    ["manager"],
                     false
                 );
             expect(manAfterFilter).to.deep.equal(filtered.manager);
@@ -380,7 +383,7 @@ describe("notManifestFilter", function () {
                 manAfterFilter = notManifestFilter.filter(
                     man,
                     false,
-                    "notActivated",
+                    ["notActivated"],
                     false
                 );
             expect(manAfterFilter).to.deep.equal(filtered.notActivated);
@@ -388,13 +391,349 @@ describe("notManifestFilter", function () {
 
         it("Admin manifest", function () {
             let man = rawRoutesManifest,
-                manAfterFilter = notManifestFilter.filter(
-                    man,
-                    false,
-                    false,
-                    true
-                );
+                manAfterFilter = notManifestFilter.filter(man, false, [], true);
             expect(manAfterFilter).to.deep.equal(filtered.admin);
         });
     });
+
+    describe("Filter fields with schema and actionSignature", () => {
+        const SCHEMA = () => {
+            return {
+                role: {
+                    type: [String],
+                    required: true,
+                    searchable: true,
+                    default: ["user"],
+                    validate: [],
+                    safe: {
+                        create: ["@system"],
+                        update: ["root", "admin"],
+                        read: ["@owner", "root", "admin"],
+                    },
+                },
+                name: {
+                    type: String,
+                    safe: {
+                        create: ["@system"],
+                        update: ["@system", "@owner", "root", "admin"],
+                        read: ["*"],
+                    },
+                },
+                salt: {
+                    type: String,
+                    required: true,
+                },
+                telephone: {
+                    type: String,
+                    unique: false,
+                    searchable: true,
+                    required: false,
+                    safe: {
+                        create: ["@system"],
+                        update: ["@owner", "root", "admin"],
+                        read: ["@owner", "root", "admin"],
+                    },
+                },
+                username: {
+                    type: String,
+                    unique: true,
+                    searchable: true,
+                    required: true,
+                    safe: {
+                        create: ["@system"],
+                        read: ["*"],
+                    },
+                },
+                confirm: {
+                    type: Schema.Types.Mixed,
+                    required: false,
+                    searchable: true,
+                    safe: {
+                        create: ["@system"],
+                        update: ["@system", "root", "admin"],
+                    },
+                },
+                code: {
+                    type: String,
+                    searchable: true,
+                    required: true,
+                },
+                country: {
+                    type: String,
+                    required: false,
+                    searchable: true,
+                    default: "ru",
+                    safe: {
+                        create: ["@system"],
+                        update: ["@system", "@owner", "root", "admin"],
+                        read: ["*"],
+                    },
+                },
+                email: {
+                    type: String,
+                    unique: true,
+                    searchable: true,
+                    required: true,
+                    safe: {
+                        create: ["@system"],
+                        update: ["@owner", "root", "admin"],
+                        read: ["@owner", "root", "admin"],
+                    },
+                },
+            };
+        };
+
+        const modelName = "User";
+        const moduleName = "User";
+
+        before(() => {
+            notManifestFilter.schemaLoader = SCHEMA;
+        });
+
+        it("filterRouteAction @safe for READ", () => {
+            const actionName = "get";
+            const actionData = {
+                actionSignature: ACTION_SIGNATURES.READ,
+                method: "get",
+                rules: [
+                    {
+                        auth: false,
+                        fields: ["@safe"],
+                    },
+                ],
+            };
+            const auth = false;
+            const root = false;
+            const roles = [DEFAULT_USER_ROLE_FOR_GUEST];
+            const routeMan = {
+                actions: {},
+            };
+            const targetResult = {
+                actions: {
+                    get: {
+                        method: "get",
+                        fields: ["name", "username", "country"],
+                    },
+                },
+            };
+            notManifestFilter.filterRouteAction(
+                actionName,
+                actionData,
+                auth,
+                roles,
+                root,
+                routeMan,
+                modelName,
+                moduleName
+            );
+            expect(routeMan).to.be.deep.equal(targetResult);
+        });
+
+        it("filterRouteAction @* for READ", () => {
+            const actionName = "get";
+            const actionData = {
+                actionSignature: ACTION_SIGNATURES.READ,
+                method: "get",
+                rules: [
+                    {
+                        auth: false,
+                        fields: ["@*"],
+                    },
+                ],
+            };
+            const auth = false;
+            const root = false;
+            const roles = [DEFAULT_USER_ROLE_FOR_GUEST];
+            const routeMan = {
+                actions: {},
+            };
+            const targetResult = {
+                actions: {
+                    get: {
+                        method: "get",
+                        fields: [
+                            "_id",
+                            "userID",
+                            "role",
+                            "name",
+                            "salt",
+                            "telephone",
+                            "username",
+                            "confirm",
+                            "code",
+                            "country",
+                            "email",
+                        ],
+                    },
+                },
+            };
+            notManifestFilter.filterRouteAction(
+                actionName,
+                actionData,
+                auth,
+                roles,
+                root,
+                routeMan,
+                modelName,
+                moduleName
+            );
+            expect(routeMan).to.be.deep.equal(targetResult);
+        });
+
+        it("filterRouteAction @*,-@safe for READ", () => {
+            const actionName = "get";
+            const actionData = {
+                actionSignature: ACTION_SIGNATURES.READ,
+                method: "get",
+                rules: [
+                    {
+                        auth: false,
+                        fields: ["@*", "-@safe"],
+                    },
+                ],
+            };
+            const auth = false;
+            const root = false;
+            const roles = [DEFAULT_USER_ROLE_FOR_GUEST];
+            const routeMan = {
+                actions: {},
+            };
+            const targetResult = {
+                actions: {
+                    get: {
+                        method: "get",
+                        fields: [
+                            "_id",
+                            "userID",
+                            "role",
+                            "salt",
+                            "telephone",
+                            "confirm",
+                            "code",
+                            "email",
+                        ],
+                    },
+                },
+            };
+            notManifestFilter.filterRouteAction(
+                actionName,
+                actionData,
+                auth,
+                roles,
+                root,
+                routeMan,
+                modelName,
+                moduleName
+            );
+            expect(routeMan).to.be.deep.equal(targetResult);
+        });
+
+        it("filterRouteAction @* for UPDATE as guest", () => {
+            const actionName = "update";
+            const actionData = {
+                actionSignature: ACTION_SIGNATURES.UPDATE,
+                method: "post",
+                rules: [
+                    {
+                        role: ["user"],
+                        fields: ["@*"],
+                    },
+                ],
+            };
+            const auth = false;
+            const root = false;
+            const roles = [DEFAULT_USER_ROLE_FOR_GUEST];
+            const routeMan = {
+                actions: {},
+            };
+            const targetResult = {
+                actions: {},
+            };
+            notManifestFilter.filterRouteAction(
+                actionName,
+                actionData,
+                auth,
+                roles,
+                root,
+                routeMan,
+                modelName,
+                moduleName
+            );
+            expect(routeMan).to.be.deep.equal(targetResult);
+        });
+
+        it("filterRouteAction @safe for CREATE as guest", () => {
+            const actionName = "create";
+            const actionData = {
+                actionSignature: ACTION_SIGNATURES.CREATE,
+                method: "put",
+                rules: [
+                    {
+                        role: ["user"],
+                        fields: ["@safe"],
+                    },
+                ],
+            };
+            const auth = false;
+            const root = false;
+            const roles = [DEFAULT_USER_ROLE_FOR_GUEST];
+            const routeMan = {
+                actions: {},
+            };
+            const targetResult = {
+                actions: {},
+            };
+            notManifestFilter.filterRouteAction(
+                actionName,
+                actionData,
+                auth,
+                roles,
+                root,
+                routeMan,
+                modelName,
+                moduleName
+            );
+            expect(routeMan).to.be.deep.equal(targetResult);
+        });
+
+        it("filterRouteAction @listFields for READ", () => {
+            const actionName = "list";
+            notFieldsFilter.addSet("listFields", ["@ID", "@safe"]);
+            const actionData = {
+                actionSignature: ACTION_SIGNATURES.READ,
+                method: "get",
+                rules: [
+                    {
+                        auth: false,
+                        fields: ["@listFields"],
+                    },
+                ],
+            };
+            const auth = false;
+            const root = false;
+            const roles = [DEFAULT_USER_ROLE_FOR_GUEST];
+            const routeMan = {
+                actions: {},
+            };
+            const targetResult = {
+                actions: {
+                    list: {
+                        method: "get",
+                        fields: ["userID", "name", "username", "country"],
+                    },
+                },
+            };
+            notManifestFilter.filterRouteAction(
+                actionName,
+                actionData,
+                auth,
+                roles,
+                root,
+                routeMan,
+                modelName,
+                moduleName
+            );
+            expect(routeMan).to.be.deep.equal(targetResult);
+        });
+    });
 });

package/test/notModule.js

@@ -89,6 +89,46 @@ describe("notModule", function () {
         });
     });
 
+    describe("getRouteManifest", () => {
+        it("getter", () => {
+            const ctx = {
+                manifests: {
+                    some: "fest",
+                },
+            };
+            const res = notModule.prototype.getRouteManifest.call(ctx, "some");
+            expect(res).to.be.equal("fest");
+        });
+    });
+
+    describe("getRoutesManifests", () => {
+        it("getter", () => {
+            const ctx = {
+                manifests: {
+                    some: "fest",
+                },
+            };
+            const res = notModule.prototype.getRoutesManifests.call(ctx);
+            expect(res).to.be.deep.equal({
+                some: "fest",
+            });
+        });
+    });
+
+    describe("getModels", () => {
+        it("getter", () => {
+            const ctx = {
+                models: {
+                    some: "fest",
+                },
+            };
+            const res = notModule.prototype.getModels.call(ctx);
+            expect(res).to.be.deep.equal({
+                some: "fest",
+            });
+        });
+    });
+
     describe("getManifest", function () {
         it("Get module manifest without params", function (done) {
             const ctx = {
@@ -101,7 +141,7 @@ describe("notModule", function () {
                             some: "fest",
                         });
                         expect(auth).to.be.false;
-                        expect(role).to.be.equal("guest");
+                        expect(role).to.be.deep.equal(["guest"]);
                         expect(root).to.be.false;
                         done();
                     },

package/test/transformers.js

@@ -0,0 +1,21 @@
+const expect = require("chai").expect,
+    transformers = require("../src/form/transformers");
+
+describe("Form//Transformers", () => {
+    it("xss", () => {
+        const stringWithAttack = "<IMG SRC=j&#X41vascript:alert('test2')>";
+        const cleanString = transformers.xss(stringWithAttack);
+        expect(stringWithAttack).to.be.not.equal(cleanString);
+    });
+
+    it("stringToJSON", () => {
+        const stringifiedJSON =
+            '{"field1": 1, "field2":true, "field3": [1,"string", false]}';
+        const json = transformers.stringToJSON(stringifiedJSON);
+        expect(json).to.be.deep.equal({
+            field1: 1,
+            field2: true,
+            field3: [1, "string", false],
+        });
+    });
+});

package/tmpl/files/module.server/layers/routes.manifest.ejs

@@ -1,3 +1,4 @@
+const ACTION_SIGNATURES = require('not-node/src/auth/const').ACTION_SIGNATURES;
 const FIELDS = [
     ["_id", "not-node//_id"],
     ["<%- modelName %>ID", "not-node//ID"],
@@ -24,6 +25,7 @@ module.exports = {
         <% if (Object.hasOwn(actions, 'create')){ %>
         create: {
             method: "put",
+            actionSignature: ACTION_SIGNATURES.CREATE,
             title: "<%- ModuleName %>:form_title_create",
             description: "<%- ModuleName %>:form_description_create",
             rules: [
@@ -45,6 +47,7 @@ module.exports = {
         <% if (Object.hasOwn(actions,'get')){ %>
         get: {
             method: "get",
+            actionSignature: ACTION_SIGNATURES.READ,
             title: "<%- ModuleName %>:form_title_details",
             description: "<%- ModuleName %>:form_description_details",
             rules: [
@@ -79,6 +82,7 @@ module.exports = {
         <% if (Object.hasOwn(actions,'getRaw')){ %>
         getRaw: {
             method: "get",
+            actionSignature: ACTION_SIGNATURES.READ,
             title: "<%- ModuleName %>:form_title_details",
             description: "<%- ModuleName %>:form_description_details",
             rules: [
@@ -125,6 +129,7 @@ module.exports = {
         <% if (Object.hasOwn(actions,'update')){ %>
         update: {
             title: "<%- ModuleName %>:form_title_update",
+            actionSignature: ACTION_SIGNATURES.UPDATE,
             description: "<%- ModuleName %>:form_description_update",
             method: "post",
             rules: [
@@ -145,6 +150,7 @@ module.exports = {
         <% } %>
         <% if (Object.hasOwn(actions,'delete')){ %>
         delete: {
+            actionSignature: ACTION_SIGNATURES.DELETE,
             title: "<%- ModuleName %>:form_title_delete",
             description: "<%- ModuleName %>:form_description_delete",
             method: "delete",
@@ -165,6 +171,7 @@ module.exports = {
         <% if (Object.hasOwn(actions,'listAndCount')){ %>
         listAndCount: {
             method: "get",
+            actionSignature: ACTION_SIGNATURES.READ,
             data: ["pager", "sorter", "filter", "search"],
             rules: [
                 {
@@ -186,6 +193,7 @@ module.exports = {
         <% if (Object.hasOwn(actions,'listAll')){ %>
         listAll: {
             method: "get",
+            actionSignature: ACTION_SIGNATURES.READ,
             data: ["record", "sorter"],
             fields: [
             <%- fields.map((entry) => `"${entry}"`).join(',')  %>,
@@ -209,3 +217,4 @@ module.exports = {
         <% } %>
     },
 };
+