not-node 6.3.78 → 6.3.80

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "not-node",
-	"version": "6.3.78",
+	"version": "6.3.80",
 	"description": "node complimentary part for client side notFramework.",
 	"main": "index.js",
 	"scripts": {
@@ -37,22 +37,22 @@
 	},
 	"dependencies": {
 		"body-parser": "^1.20.2",
-		"commander": "^12.0.0",
+		"commander": "^12.1.0",
 		"compression": "^1.7.4",
 		"connect-mongodb-session": "^5.0.0",
 		"connect-redis": "^7.1.1",
 		"cors": "^2.8.5",
 		"deep-diff": "*",
 		"deepmerge": "^4.3.1",
-		"ejs": "^3.1.9",
+		"ejs": "^3.1.10",
 		"escape-string-regexp": "*",
-		"express": "^4.19.1",
+		"express": "^4.19.2",
 		"express-fileupload": "^1.5.0",
 		"express-session": "^1.18.0",
 		"fs-extra": "*",
 		"generate-password": "^1.7.1",
 		"helmet": "^7.1.0",
-		"inquirer": "^9.2.16",
+		"inquirer": "^9.3.4",
 		"jsonwebtoken": "^9.0.2",
 		"lower-case": "*",
 		"method-override": "^3.0.0",
@@ -65,11 +65,11 @@
 		"not-log": "*",
 		"not-monitor": "*",
 		"not-path": "*",
-		"rate-limiter-flexible": "^5.0.0",
-		"redis": "^4.6.13",
+		"rate-limiter-flexible": "^5.0.3",
+		"redis": "^4.6.15",
 		"redlock": "^5.0.0-beta.2",
-		"rfdc": "^1.3.1",
-		"rimraf": "^5.0.5",
+		"rfdc": "^1.4.1",
+		"rimraf": "^5.0.8",
 		"serve-static": "*",
 		"simple-git": "*",
 		"validator": "*",
@@ -80,23 +80,23 @@
 		"babel-eslint": "^10.1.0",
 		"chai": "*",
 		"chai-as-promised": "*",
-		"eslint": "^8.57.0",
+		"eslint": "^9.6.0",
 		"eslint-plugin-node": "^11.1.0",
-		"eslint-plugin-sonarjs": "^0.24.0",
+		"eslint-plugin-sonarjs": "^1.0.3",
 		"husky": "^9.0.11",
 		"ink-docstrap": "^1.3.2",
-		"ioredis": "^5.3.2",
-		"jsdoc": "^4.0.2",
+		"ioredis": "^5.4.1",
+		"jsdoc": "^4.0.3",
 		"mocha": "*",
 		"mocha-suppress-logs": "^0.5.1",
 		"mock-require": "^3.0.3",
-		"mongodb-memory-server": "^9.1.7",
-		"mongoose": "^8.2.3",
+		"mongodb-memory-server": "^9.4.0",
+		"mongoose": "^8.4.5",
 		"not-error": "^0.2.9",
 		"not-validation": "^0.0.9",
 		"npm-run-all": "^4.1.5",
-		"nyc": "^15.1.0",
-		"retire": "^4.4.2"
+		"nyc": "^17.0.0",
+		"retire": "^5.1.1"
 	},
 	"homepage": "https://github.com/interrupter/not-node#readme",
 	"nyc": {

package/src/auth/const.js

@@ -23,6 +23,7 @@ const METHOD_SIGNAURES = {
     GET: ACTION_SIGNATURES.READ,
     PUT: ACTION_SIGNATURES.CREATE,
     POST: ACTION_SIGNATURES.UPDATE,
+    PATCH: ACTION_SIGNATURES.UPDATE,
     DELETE: ACTION_SIGNATURES.DELETE,
 };
 

package/src/manifest/manifest.filter.js

@@ -95,7 +95,10 @@ module.exports = class notManifestFilter {
                                 root,
                                 modelName,
                                 moduleName,
-                                actionSignature: actionSet.actionSignature,
+                                actionSignature:
+                                    notManifestFilter.detectActionSignature(
+                                        actionSet
+                                    ),
                             }
                         );
                     break;
@@ -113,7 +116,10 @@ module.exports = class notManifestFilter {
                             root,
                             modelName,
                             moduleName,
-                            actionSignature: actionSet.actionSignature,
+                            actionSignature:
+                                notManifestFilter.detectActionSignature(
+                                    actionSet
+                                ),
                         }
                     );
             }
@@ -165,6 +171,24 @@ module.exports = class notManifestFilter {
         );
     }
 
+    /**
+     * Return true if ruleSet object has not empty list of return and return is an Array<string>
+     * @param {Object} ruleSet specific set of rules for action
+     * @return {boolean} if rule set has not empty fields list
+     */
+    static ruleSetHasReturnDirectiveInAllStringFormat(ruleSet) {
+        return (
+            typeof ruleSet !== "undefined" &&
+            ruleSet !== null &&
+            ruleSet.return &&
+            Array.isArray(ruleSet.return) &&
+            ruleSet.return.length &&
+            ruleSet.return.every(
+                (returnFieldName) => typeof returnFieldName === "string"
+            )
+        );
+    }
+
     static composeFullModelName(moduleName, modelName) {
         if (modelName) {
             if (moduleName) {
@@ -184,6 +208,69 @@ module.exports = class notManifestFilter {
         }
     }
 
+    /**
+     *
+     * Returns Action signature for action
+     * @static
+     * @param {import('../types').notActionData} action
+     * @return {string}
+     */
+    static detectActionSignature(action) {
+        if (action) {
+            switch (action?.method?.toLocaleLowerCase()) {
+                case "get":
+                    return Auth.ACTION_SIGNATURES.READ;
+
+                case "post":
+                case "patch":
+                    return Auth.ACTION_SIGNATURES.UPDATE;
+
+                case "put":
+                    return Auth.ACTION_SIGNATURES.CREATE;
+
+                case "delete":
+                    return Auth.ACTION_SIGNATURES.DELETE;
+
+                default:
+                    return Auth.ACTION_SIGNATURES.READ;
+            }
+        }
+        return Auth.ACTION_SIGNATURES.READ;
+    }
+
+    static filterReturnSet(
+        returnSet,
+        modelSchema,
+        {
+            auth = false,
+            role = [Auth.DEFAULT_USER_ROLE_FOR_GUEST],
+            root = false,
+            modelName = "",
+            actionSignature = undefined,
+        } = {
+            auth: false,
+            role: [Auth.DEFAULT_USER_ROLE_FOR_GUEST],
+            root: false,
+            modelName: "",
+            actionSignature: undefined,
+        }
+    ) {
+        if (
+            notManifestFilter.ruleSetHasReturnDirectiveInAllStringFormat({
+                return: returnSet,
+            })
+        ) {
+            return notFieldsFilter.filter([...returnSet], modelSchema, {
+                action: actionSignature,
+                roles: role,
+                auth,
+                root,
+                modelName,
+            });
+        }
+        return returnSet;
+    }
+
     /**
      *  Clear action definition from rules of access
      *  @param      {object}                action   action data
@@ -221,17 +308,29 @@ module.exports = class notManifestFilter {
         //copy fields list from rule to action if it exists
         //fields list is used to restrict fields of data that could be accessed via
         //this action
+        const fullModelName = this.composeFullModelName(moduleName, modelName);
+        const modelSchema = this.loadSchema(fullModelName);
         if (notManifestFilter.ruleSetHasFieldsDirective(ruleSet)) {
-            const fullModelName = this.composeFullModelName(
-                moduleName,
-                modelName
-            );
             copy.fields = notFieldsFilter.filter(
                 [...ruleSet.fields],
-                this.loadSchema(fullModelName),
+                modelSchema,
                 { action: actionSignature, roles: role, auth, root, modelName }
             );
         }
+        if (ruleSet && ruleSet.return) {
+            copy.return = notManifestFilter.filterReturnSet(
+                ruleSet.return,
+                modelSchema,
+                {
+                    auth,
+                    role,
+                    root,
+                    modelName,
+                    moduleName,
+                    actionSignature,
+                }
+            );
+        }
         return copy;
     }
 

package/src/manifest/result.filter.js

@@ -1,5 +1,8 @@
 const notPath = require("not-path");
 const { objHas, copyObj } = require("../common");
+const notManifestFilter = require("./manifest.filter");
+
+const Auth = require("../auth/const");
 
 const PROP_NAME_RETURN_ROOT = "returnRoot"; //path to object to filter
 const PROP_NAME_RETURN_RULE = "return"; //filtering rule
@@ -62,15 +65,38 @@ module.exports = class notManifestRouteResultFilter {
      * if presented
      * @param {object} notRouteData request rules and preferencies
      * @param {object} result result returned by main action processor
+     * @param {import('../types').notAppIdentityShortData} identity
      */
-    static filter(notRouteData, result) {
+    static filter(
+        notRouteData,
+        result,
+        identity = {
+            auth: false,
+            admin: false,
+            root: false,
+            primaryRole: Auth.DEFAULT_USER_ROLE_FOR_GUEST,
+            role: [Auth.DEFAULT_USER_ROLE_FOR_GUEST],
+        }
+    ) {
         if (!(result && typeof result === "object")) return;
-        const filteringRule = this.getFilteringRule(notRouteData);
+        let filteringRule = this.getFilteringRule(notRouteData);
         if (!filteringRule) return;
         const filteringTarget = this.getFilteringTarget(result, notRouteData);
         if (!filteringTarget) {
             return;
         }
+        filteringRule = notManifestFilter.filterReturnSet(
+            filteringRule,
+            notManifestFilter.loadSchema(notRouteData.modelPath),
+            {
+                auth: identity.auth,
+                role: identity.role,
+                root: identity.root,
+                modelName: notRouteData.modelName,
+                moduleName: notRouteData.moduleName,
+                actionSignature: notRouteData.actionSignature,
+            }
+        );
         if (Array.isArray(filteringTarget)) {
             filteringTarget.forEach((filteringTargetItem) => {
                 this.filterByRule(

package/src/manifest/route.js

@@ -8,7 +8,13 @@ const Auth = require("../auth"),
     HttpError = require("../error").Http;
 
 const notManifestRouteResultFilter = require("./result.filter");
-const { copyObj, executeObjectFunction } = require("../common");
+const notManifestFilter = require("./manifest.filter");
+
+const {
+    copyObj,
+    executeObjectFunction,
+    firstLetterToUpper,
+} = require("../common");
 
 /**
  *	Route representation
@@ -105,8 +111,15 @@ class notRoute {
         return {
             actionName,
             modelName: this.routeName,
+            moduleName: this.moduleName,
+            modelPath: `${this.moduleName}//${firstLetterToUpper(
+                this.routeName
+            )}`,
             rule: copyObj(rule),
             actionData: copyObj(this.actionData),
+            actionSignature: notManifestFilter.detectActionSignature(
+                this.actionData
+            ),
         };
     }
 
@@ -234,7 +247,11 @@ class notRoute {
                         itm && itm.toObject ? itm.toObject() : itm
                     );
                 }
-                notManifestRouteResultFilter.filter(req.notRouteData, result);
+                notManifestRouteResultFilter.filter(
+                    req.notRouteData,
+                    result,
+                    notAppIdentity.extractAuthData(req)
+                );
             }
             //run after with results, continue without waiting when it finished
             if (modRoute[CONST_AFTER_ACTION]) {

package/src/types.js

@@ -65,8 +65,11 @@
  * @typedef    {Object}             notRouteData
  * @property   {string}             actionName          name of action
  * @property   {string}             modelName           first letter should not be not capital
+ * @property   {string}             moduleName          first letter should not be not capital
+ * @property   {string}             modelPath           arg for getModel/getSchema
  * @property   {notRouteRule}       rule                current rule
  * @property   {notActionData}      actionData          action details
+ * @property   {string}             actionSignature     action signature
  */
 
 /**
@@ -104,6 +107,16 @@
  * @property    {string}        provider    //provider class name
  */
 
+/**
+ *
+ * @typedef     {object}        notAppIdentityShortData
+ * @property    {boolean}       root        //system configuration administrator
+ * @property    {boolean}       admin       //system content administrator
+ * @property    {boolean}       auth        //authenticated user
+ * @property    {Array<string>} role        //list of roles, exactly one should be primary role
+ * @property    {string}        primaryRole //primary role
+ */
+
 /**
  * @typedef     {string|function}    notAppFormPropertyProcessingPipeInstruction
  */

package/test/result.filter.js

@@ -23,7 +23,7 @@ describe("notManifestRouteResultFilter", function () {
             const notRouteData = {
                 rule: { returnRoot: "result", return: ["some"] },
             };
-            notManifestRouteResultFilter.filter(notRouteData, reqRes);
+            notManifestRouteResultFilter.filter(notRouteData, reqRes, {});
             expect(reqRes).to.be.deep.equal({ some: "data" });
         });
 
@@ -32,7 +32,7 @@ describe("notManifestRouteResultFilter", function () {
             const notRouteData = {
                 rule: { return: ["some"] },
             };
-            notManifestRouteResultFilter.filter(notRouteData, reqRes);
+            notManifestRouteResultFilter.filter(notRouteData, reqRes, {});
             expect(reqRes).to.be.deep.equal({ some: "data" });
         });
 
@@ -45,7 +45,7 @@ describe("notManifestRouteResultFilter", function () {
             const notRouteData = {
                 rule: { return: ["id"] },
             };
-            notManifestRouteResultFilter.filter(notRouteData, reqRes);
+            notManifestRouteResultFilter.filter(notRouteData, reqRes, {});
             expect(reqRes).to.be.deep.equal([
                 { id: 1 },
                 { id: 11 },