not-node 6.3.48 → 6.3.50

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "not-node",
-	"version": "6.3.48",
+	"version": "6.3.50",
 	"description": "node complimentary part for client side notFramework.",
 	"main": "index.js",
 	"scripts": {

package/src/auth/const.js

@@ -19,6 +19,13 @@ const ACTION_SIGNATURES = {
     ANY: ACTION_SIGNATURE_ANY,
 };
 
+const METHOD_SIGNAURES = {
+    GET: ACTION_SIGNATURES.READ,
+    PUT: ACTION_SIGNATURES.CREATE,
+    POST: ACTION_SIGNATURES.UPDATE,
+    DELETE: ACTION_SIGNATURES.DELETE,
+};
+
 const OBJECT_STRING = "[object String]";
 
 const DOCUMENT_OWNER_FIELD_NAME = "owner";
@@ -32,4 +39,5 @@ module.exports = {
     DEFAULT_USER_ROLE_FOR_ADMIN,
     DOCUMENT_OWNER_FIELD_NAME,
     ACTION_SIGNATURES,
+    METHOD_SIGNAURES,
 };

package/src/form/form.js

@@ -1,8 +1,11 @@
+const Schema = require("mongoose").Schema;
 const validator = require("validator");
 const notPath = require("not-path");
 const FormFabric = require("./fabric");
+const Auth = require("../auth");
 const { createSchemaFromFields } = require("../fields");
-
+const notFieldsFilter = require("../fields/filter.js");
+const getApp = require("../getApp.js");
 const {
     objHas,
     isFunc,
@@ -27,6 +30,7 @@ const {
 const DEFAULT_EXTRACTORS = require("./extractors");
 const DEFAULT_ID_EXTRACTORS = require("./env_extractors");
 const DEFAULT_TRANSFORMERS = require("./transformers");
+const notAppIdentity = require("../identity/index.js");
 
 /**
  * Generic form validation class
@@ -41,6 +45,7 @@ class Form {
         form: [],
         forms: {},
     };
+    #MODEL_SCHEMA;
     /**
      * @prop {string} name of form
      **/
@@ -521,7 +526,7 @@ class Form {
     /**
      *
      * @param {import('../types').notNodeExpressRequest}   req     Express Request
-     * @returns {Array<string>|Array<Array<string>>}
+     * @returns {Array<string>}
      */
     extractActionFieldsFromRequest(req) {
         if (
@@ -539,6 +544,68 @@ class Form {
         return [];
     }
 
+    /**
+     *
+     * @param {import('../types.js').notActionData} actionData
+     * @returns
+     */
+    getActionSignature(actionData) {
+        if (actionData.actionSignature) {
+            return actionData.actionSignature;
+        } else if (actionData.method && typeof actionData.method === "string") {
+            const METHOD = actionData.method.toUpperCase();
+            if (objHas(Auth.METHOD_SIGNAURES, METHOD)) {
+                return Auth.METHOD_SIGNAURES[METHOD];
+            }
+        }
+        return Auth.ACTION_SIGNATURES.ANY;
+    }
+
+    /**
+     *
+     * @param {import('../types.js').notNodeExpressRequest} req
+     * @returns {import('../fields/filter.js').FieldsFilteringModificators}
+     */
+    extractActionMods(req) {
+        const authData = notAppIdentity.extractAuthData(req);
+        /**
+         * @type {import('../types.js').notRouteData}
+         */
+        const routeData = req.notRouteData;
+        let action = this.getActionSignature(req.notRouteData.actionData);
+        if (
+            action === Auth.ACTION_SIGNATURES.ANY &&
+            routeData.actionName &&
+            routeData.actionName.length
+        ) {
+            action = routeData.actionName;
+        }
+        return {
+            auth: authData.auth,
+            roles: authData.role,
+            root: authData.root,
+            modelName: routeData.modelName,
+            action,
+        };
+    }
+
+    /**
+     *
+     * @param {Object} schemaField
+     */
+    extractDefaultTransformers(schemaField) {
+        if (typeof schemaField === "undefined" || schemaField === null) {
+            return [];
+        }
+        switch (schemaField.type) {
+            case String:
+            case Schema.Types.String:
+                return ["xss"];
+            default:
+                return [];
+        }
+    }
+
     /**
      *
      * @param {import('../types.js').notNodeExpressRequest} req
@@ -548,16 +615,34 @@ class Form {
      */
     createInstructionFromRouteActionFields(
         req,
-        mainInstruction = ["fromBody", "xss"],
+        mainInstruction = ["fromBody"],
         exceptions = {}
     ) {
         const result = {};
         const fields = this.extractActionFieldsFromRequest(req);
-        fields.forEach((fieldName) => {
+        const schema = getApp().getModelSchema(
+            `${this.getModuleName()}//${this.getModelName(req)}`
+        );
+        const filteredFields = notFieldsFilter.filter(
+            fields,
+            schema,
+            this.extractActionMods(req)
+        );
+        filteredFields.forEach((fieldName) => {
             if (objHas(exceptions, fieldName)) {
                 result[fieldName] = exceptions[fieldName];
             } else {
-                result[fieldName] = mainInstruction;
+                const fieldTransformers = this.extractDefaultTransformers(
+                    schema[fieldName]
+                );
+                if (Array.isArray(fieldTransformers)) {
+                    result[fieldName] = [
+                        ...mainInstruction,
+                        ...fieldTransformers,
+                    ];
+                } else {
+                    result[fieldName] = [...mainInstruction];
+                }
             }
         });
         // @ts-ignore
@@ -574,7 +659,7 @@ class Form {
      */
     extractByInstructionsFromRouteActionFields(
         req,
-        mainInstruction = ["fromBody", "xss"],
+        mainInstruction = ["fromBody"],
         exceptions = {},
         additional = {}
     ) {

package/src/manifest/manifest.filter.js

@@ -194,7 +194,7 @@ module.exports = class notManifestFilter {
      *  @param      {Array<string>}         mods.role
      *  @param      {string}                mods.modelName
      *  @param      {string}                mods.moduleName
-     *  @param      {string|undefined}                mods.actionSignature    create/read/update/delete
+     *  @param      {string|undefined}      mods.actionSignature    create/read/update/delete
      *  @return     {object}               clean action data
      **/
     static clearActionFromRules(

package/src/types.js

@@ -49,24 +49,24 @@
 
 /**
  * @typedef    {object}                         notActionData
- * @property   {string}                         [method]
- * @property   {string}                         [actionSignature]
- * @property   {string}                         [postFix]
- * @property   {Array<notRouteRule>}               rules
- * @property   {boolean}                        [ws]
- * @property   {Array<string & Array<string>>}  [fields]
- * @property   {Array<string>}                  [return]
- * @property   {boolean}                        [isArray]
- * @property   {Array<string>}                  [data]
- * @property   {string}                         [title]
- */
-
-/**
- * @typedef    {Object}       notRouteData
- * @property   {string}       actionName
- * @property   {string}       modelName
- * @property   {notRouteRule}    rule
- * @property   {notActionData}   actionData
+ * @property   {string}                         [method]            HTTP method name GET,PUT,POST,DELETE
+ * @property   {string}                         [actionSignature]   one of create,read,update,delete,any
+ * @property   {string}                         [postFix]           uri rule
+ * @property   {Array<notRouteRule>}            rules               access rules
+ * @property   {boolean}                        [ws]                use WS routers for this actions
+ * @property   {Array<string & Array<string>>}  [fields]            array of fields names or fields set aliases, used in form generators, validators
+ * @property   {Array<string>}                  [return]            rule to filter results, used to exclude from response sensetive data
+ * @property   {boolean}                        [isArray]           obsolete
+ * @property   {Array<string>}                  [data]              list consisting of sources (pager,sorter,search,record) for request generation on client side
+ * @property   {string}                         [title]             used in form generators
+ */
+
+/**
+ * @typedef    {Object}             notRouteData
+ * @property   {string}             actionName          name of action
+ * @property   {string}             modelName           first letter should not be not capital
+ * @property   {notRouteRule}       rule                current rule
+ * @property   {notActionData}      actionData          action details
  */
 
 /**