not-node 6.3.94 → 6.3.96

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "not-node",
-	"version": "6.3.94",
+	"version": "6.3.96",
 	"description": "node complimentary part for client side notFramework.",
 	"main": "index.js",
 	"scripts": {

package/src/core/fields/ID.js

@@ -8,5 +8,6 @@ module.exports = {
     model: {
         type: Number,
         required: true,
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/_id.js

@@ -5,4 +5,7 @@ module.exports = {
         label: "_id",
         readonly: true,
     },
+    model: {
+        safe: require("../safety.protocols").systemManageable,
+    },
 };

package/src/core/fields/active.js

@@ -6,6 +6,7 @@ module.exports = {
     model: {
         type: Boolean,
         default: false,
-        required: true
+        required: true,
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/boolean.js

@@ -6,6 +6,7 @@ module.exports = {
     model: {
         type: Boolean,
         default: false,
-        required: true
+        required: true,
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/codeName.js

@@ -7,6 +7,7 @@ module.exports = {
     model: {
         type: String,
         required: true,
-        transformers: ['xss']
+        transformers: ["xss"],
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/createdAt.js

@@ -11,9 +11,6 @@ module.exports = {
         default: Date.now,
         searchable: true,
         sortable: true,
-        safe: {
-            create: ["@system"],
-            read: ["@owner", "root", "admin"],
-        },
+        safe: require("../safety.protocols").systemManageable,
     },
 };

package/src/core/fields/default.js

@@ -7,5 +7,6 @@ module.exports = {
         type: Boolean,
         default: false,
         required: true,
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/description.js

@@ -9,6 +9,7 @@ module.exports = {
         required: true,
         searchable: true,
         sortable: true,
-        transformers: ['xss']
+        transformers: ["xss"],
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/email.js

@@ -7,6 +7,7 @@ module.exports = {
     model: {
         type: String,
         required: true,
-        transformers: ['xss']
+        transformers: ["xss"],
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/enabled.js

@@ -7,5 +7,6 @@ module.exports = {
         type: Boolean,
         default: true,
         required: true,
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/expiredAt.js

@@ -10,9 +10,6 @@ module.exports = {
         required: false,
         searchable: true,
         sortable: true,
-        safe: {
-            update: ["@owner", "root", "admin"],
-            read: ["@owner", "root", "admin"],
-        },
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/height.js

@@ -9,5 +9,6 @@ module.exports = {
         required: true,
         searchable: true,
         sortable: true,
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/identity.js

@@ -4,9 +4,6 @@ module.exports = {
     model: {
         type: Schema.Types.Mixed,
         required: true,
-        safe: {
-            update: ["@owner", "root", "admin"],
-            read: ["@owner", "root", "admin"],
-        },
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/ip.js

@@ -8,6 +8,7 @@ module.exports = {
         type: String,
         searchable: true,
         required: true,
-        transformers: ['xss']
+        safe: require("../safety.protocols").ownerRootAdmin,
+        transformers: ["xss"],
     },
 };

package/src/core/fields/objectId.js

@@ -5,9 +5,7 @@ module.exports = {
         type: ObjectId,
         required: true,
         default: {},
-        safe: {
-            update: ["@owner", "root", "admin"],
-            read: ["@owner", "root", "admin"],
-        },
+        transformers: ["xss", "__CLEAR__"],
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/owner.js

@@ -1,13 +1,18 @@
 const Schema = require("mongoose").Schema;
+const notFieldsFilter = require("../../fields/filter");
+const { ownerRootAdmin } = require("../safety.protocols");
+const { ACTION_SIGNATURES } = require("../../auth/const");
+
 module.exports = {
     model: {
         type: Schema.Types.ObjectId,
         refPath: "ownerModel",
         required: false,
-        safe: {
-            update: ["root", "admin"],
-            read: ["@owner", "root", "admin"],
-        },
+        safe: notFieldsFilter.mergeSafetyProtocols(ownerRootAdmin, {
+            [ACTION_SIGNATURES.CREATE]: ["-@owner"],
+            [ACTION_SIGNATURES.UPDATE]: ["-@owner"],
+            [ACTION_SIGNATURES.DELETE]: ["-@owner"],
+        }),
     },
     ui: {
         component: "UIHidden",

package/src/core/fields/ownerModel.js

@@ -2,11 +2,8 @@ module.exports = {
     model: {
         type: String,
         required: false,
-        safe: {
-            update: ["@owner", "root", "admin"],
-            read: ["@owner", "root", "admin"],
-        },
-        transformers: ['xss']
+        safe: require("../safety.protocols").ownerRootAdmin,
+        transformers: ["xss"],
     },
     ui: {
         component: "UIHidden",

package/src/core/fields/price.js

@@ -9,5 +9,6 @@ module.exports = {
         required: true,
         searchable: true,
         sortable: true,
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/requiredObject.js

@@ -5,9 +5,6 @@ module.exports = {
         type: Schema.Types.Mixed,
         required: true,
         default: {},
-        safe: {
-            update: ["@owner", "root", "admin"],
-            read: ["@owner", "root", "admin"],
-        },
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/session.js

@@ -8,6 +8,7 @@ module.exports = {
         type: String,
         searchable: true,
         required: true,
-        transformers: ['xss']
+        transformers: ["xss"],
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/size.js

@@ -9,5 +9,6 @@ module.exports = {
         required: true,
         searchable: true,
         sortable: true,
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/telephone.js

@@ -7,6 +7,7 @@ module.exports = {
     model: {
         type: String,
         required: true,
-        transformers: ['xss']
+        transformers: ["xss"],
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/title.js

@@ -9,10 +9,7 @@ module.exports = {
         required: true,
         searchable: true,
         sortable: true,
-        safe: {
-            update: ["@owner", "root", "admin"],
-            read: ["@owner", "root", "admin"],
-        },
-        transformers: ['xss']
+        safe: require("../safety.protocols").ownerRootAdmin,
+        transformers: ["xss"],
     },
 };

package/src/core/fields/updatedAt.js

@@ -11,9 +11,6 @@ module.exports = {
         type: Date,
         required: true,
         default: Date.now,
-        safe: {
-            update: ["@owner", "root", "admin"],
-            read: ["@owner", "root", "admin"],
-        },
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/userId.js

@@ -10,5 +10,6 @@ module.exports = {
         type: Schema.Types.ObjectId,
         ref: "User",
         required: false,
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/uuid.js

@@ -9,6 +9,7 @@ module.exports = {
         type: String,
         searchable: true,
         required: true,
-        transformers: ['xss']
+        transformers: ["xss"],
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/fields/width.js

@@ -9,5 +9,6 @@ module.exports = {
         required: true,
         searchable: true,
         sortable: true,
+        safe: require("../safety.protocols").ownerRootAdmin,
     },
 };

package/src/core/safety.protocols.js

@@ -0,0 +1,22 @@
+const { ACTION_SIGNATURES } = require("../auth/const");
+
+module.exports.ownerRootAdmin = Object.freeze({
+    [ACTION_SIGNATURES.CREATE]: ["@owner", "root", "admin"],
+    [ACTION_SIGNATURES.READ]: ["@owner", "root", "admin"],
+    [ACTION_SIGNATURES.UPDATE]: ["@owner", "root", "admin"],
+    [ACTION_SIGNATURES.DELETE]: ["@owner", "root", "admin"],
+});
+
+module.exports.systemManageable = Object.freeze({
+    [ACTION_SIGNATURES.CREATE]: ["@system"],
+    [ACTION_SIGNATURES.READ]: ["@system", "@owner", "root", "admin"],
+    [ACTION_SIGNATURES.UPDATE]: ["@system"],
+    [ACTION_SIGNATURES.DELETE]: ["@system"],
+});
+
+module.exports.publicReadable = Object.freeze({
+    [ACTION_SIGNATURES.CREATE]: [],
+    [ACTION_SIGNATURES.READ]: ["@*"],
+    [ACTION_SIGNATURES.UPDATE]: [],
+    [ACTION_SIGNATURES.DELETE]: [],
+});

package/src/fields/filter.js

@@ -5,7 +5,10 @@ const {
     isNotEmptyString,
 } = require("../common");
 const { getSafeFieldsForRoleAction } = require("../auth/fields");
-const { DEFAULT_USER_ROLE_FOR_GUEST } = require("../auth/const");
+const {
+    DEFAULT_USER_ROLE_FOR_GUEST,
+    ACTION_SIGNATURES,
+} = require("../auth/const");
 /**
  * notFieldsFilter.filter(fields, getApp().getModelSchema(MODEL_NAME), {action});
  *
@@ -125,9 +128,14 @@ class notFieldsFilter {
                     system
                 );
             },
-            [SPECIAL_SET_UNSAFE]: ["salt", "password"],
+            [SPECIAL_SET_UNSAFE]: ["salt", "password", "session"],
             [SPECIAL_SET_TIMESTAMPS]: ["createdAt", "updatedAt"],
-            [SPECIAL_SET_OWNAGE]: ["owner", "ownerId", "ownerModel"],
+            [SPECIAL_SET_OWNAGE]: (schema) => {
+                const inSchema = Object.keys(schema);
+                return ["owner", "ownerId", "ownerModel"].filter((itm) =>
+                    inSchema.includes(itm)
+                );
+            },
             [SPECIAL_SET_VERSIONING]: [
                 "__version",
                 "__versions",
@@ -302,6 +310,10 @@ class notFieldsFilter {
         return result;
     }
 
+    static clearFromDuplicated(fields) {
+        return [...new Set(fields)];
+    }
+
     /**
      * Creates plain fields list from fields list with fields, synonyms, fields sets
      * and exlude operations
@@ -320,7 +332,74 @@ class notFieldsFilter {
     static filter(fieldsSet, schema = {}, mods = { action: undefined }) {
         const fields = [...fieldsSet];
         this.specialsToPlain(fields, schema, mods);
-        return this.removeExcludedFields(fields);
+        return this.clearFromDuplicated(this.removeExcludedFields(fields));
+    }
+
+    /**
+     *
+     *
+     * @static
+     * @param {Object} base
+     * @param {Object} addition
+     * @return {Object}
+     * @memberof notFieldsFilter
+     */
+    static mergeSafetyProtocols(base, addition) {
+        const result = {
+            [ACTION_SIGNATURES.CREATE]: [
+                ...(base[ACTION_SIGNATURES.CREATE] || []),
+            ],
+            [ACTION_SIGNATURES.READ]: [...(base[ACTION_SIGNATURES.READ] || [])],
+            [ACTION_SIGNATURES.UPDATE]: [
+                ...(base[ACTION_SIGNATURES.UPDATE] || []),
+            ],
+            [ACTION_SIGNATURES.DELETE]: [
+                ...(base[ACTION_SIGNATURES.DELETE] || []),
+            ],
+        };
+        for (const type of Object.keys(addition)) {
+            if (Array.isArray(addition[type])) {
+                addition[type].forEach((rule) => {
+                    if (this.isExcludeOperation(rule)) {
+                        const ruleToDelete = this.unmarkFieldToExlude(rule);
+                        if (result[type].includes(ruleToDelete)) {
+                            result[type].splice(
+                                result[type].indexOf(ruleToDelete),
+                                1
+                            );
+                        }
+                    } else {
+                        if (!result[type].includes(rule)) {
+                            result[type].push(rule);
+                        }
+                    }
+                });
+            }
+        }
+        return Object.freeze(result);
+    }
+
+    static initSafetyProtocol(
+        create = [],
+        read = [],
+        update = [],
+        del = [],
+        all = []
+    ) {
+        return this.mergeSafetyProtocols(
+            {
+                [ACTION_SIGNATURES.CREATE]: [...all],
+                [ACTION_SIGNATURES.READ]: [...all],
+                [ACTION_SIGNATURES.UPDATE]: [...all],
+                [ACTION_SIGNATURES.DELETE]: [...all],
+            },
+            {
+                [ACTION_SIGNATURES.CREATE]: [...create],
+                [ACTION_SIGNATURES.READ]: [...read],
+                [ACTION_SIGNATURES.UPDATE]: [...update],
+                [ACTION_SIGNATURES.DELETE]: [...del],
+            }
+        );
     }
 }
 

package/src/form/transformers/__CLEAR__.js

@@ -0,0 +1,3 @@
+module.exports = (input) => {
+    return input === "__CLEAR__" ? undefined : input;
+};

package/src/form/transformers/index.js

@@ -6,4 +6,5 @@ module.exports = {
     stringToJSON: require("./stringToJSON.js"),
     xss: require("./xss.js"),
     boolean: require("./boolean.js"),
+    __CLEAR__: require("./__CLEAR__.js"),
 };

package/test/filter.js

@@ -1,7 +1,9 @@
 const mongoose = require("mongoose");
 const Schema = mongoose.Schema;
 const expect = require("chai").expect,
-    notFieldsFilter = require("../src/fields/filter");
+    notFieldsFilter = require("../src/fields/filter"),
+    { ACTION_SIGNATURES } = require("../src/auth/const"),
+    safetyProtocols = require("../src/core/safety.protocols");
 
 const SCHEMA = () => {
     return {
@@ -277,10 +279,101 @@ describe("Fields/notFieldsFilter", function () {
             expect(result).to.be.deep.equal([
                 "id",
                 "name",
-                "name",
                 "username",
                 "country",
             ]);
         });
     });
+
+    describe("mergeSafetyProtocols", () => {
+        it("ownerRootAdmin + publicReadable", () => {
+            const result = notFieldsFilter.mergeSafetyProtocols(
+                safetyProtocols.ownerRootAdmin,
+                safetyProtocols.publicReadable
+            );
+            expect(result).to.be.deep.equal({
+                [ACTION_SIGNATURES.CREATE]: ["@owner", "root", "admin"],
+                [ACTION_SIGNATURES.READ]: ["@owner", "root", "admin", "@*"],
+                [ACTION_SIGNATURES.UPDATE]: ["@owner", "root", "admin"],
+                [ACTION_SIGNATURES.DELETE]: ["@owner", "root", "admin"],
+            });
+        });
+
+        it("ownerRootAdmin - @owner", () => {
+            const result = notFieldsFilter.mergeSafetyProtocols(
+                safetyProtocols.ownerRootAdmin,
+                {
+                    [ACTION_SIGNATURES.CREATE]: ["-@owner"],
+                    [ACTION_SIGNATURES.READ]: ["-@owner"],
+                    [ACTION_SIGNATURES.UPDATE]: ["-@owner"],
+                    [ACTION_SIGNATURES.DELETE]: ["-@owner"],
+                }
+            );
+            expect(result).to.be.deep.equal({
+                [ACTION_SIGNATURES.CREATE]: ["root", "admin"],
+                [ACTION_SIGNATURES.READ]: ["root", "admin"],
+                [ACTION_SIGNATURES.UPDATE]: ["root", "admin"],
+                [ACTION_SIGNATURES.DELETE]: ["root", "admin"],
+            });
+        });
+    });
+
+    describe("initSafetyProtocol", () => {
+        it("empty", () => {
+            const result = notFieldsFilter.initSafetyProtocol();
+            expect(result).to.be.deep.equal({
+                [ACTION_SIGNATURES.CREATE]: [],
+                [ACTION_SIGNATURES.READ]: [],
+                [ACTION_SIGNATURES.UPDATE]: [],
+                [ACTION_SIGNATURES.DELETE]: [],
+            });
+        });
+
+        it("all = user", () => {
+            const result = notFieldsFilter.initSafetyProtocol(
+                undefined,
+                undefined,
+                undefined,
+                undefined,
+                ["user"]
+            );
+            expect(result).to.be.deep.equal({
+                [ACTION_SIGNATURES.CREATE]: ["user"],
+                [ACTION_SIGNATURES.READ]: ["user"],
+                [ACTION_SIGNATURES.UPDATE]: ["user"],
+                [ACTION_SIGNATURES.DELETE]: ["user"],
+            });
+        });
+
+        it("CRUD - @owner", () => {
+            const result = notFieldsFilter.initSafetyProtocol(
+                ["@owner"],
+                ["@owner"],
+                ["@owner"],
+                ["@owner"]
+            );
+            expect(result).to.be.deep.equal({
+                [ACTION_SIGNATURES.CREATE]: ["@owner"],
+                [ACTION_SIGNATURES.READ]: ["@owner"],
+                [ACTION_SIGNATURES.UPDATE]: ["@owner"],
+                [ACTION_SIGNATURES.DELETE]: ["@owner"],
+            });
+        });
+
+        it("D - -@owner, ALL - @owner, root, admin", () => {
+            const result = notFieldsFilter.initSafetyProtocol(
+                undefined,
+                undefined,
+                undefined,
+                ["-@owner"],
+                ["@owner", "root", "admin"]
+            );
+            expect(result).to.be.deep.equal({
+                [ACTION_SIGNATURES.CREATE]: ["@owner", "root", "admin"],
+                [ACTION_SIGNATURES.READ]: ["@owner", "root", "admin"],
+                [ACTION_SIGNATURES.UPDATE]: ["@owner", "root", "admin"],
+                [ACTION_SIGNATURES.DELETE]: ["root", "admin"],
+            });
+        });
+    });
 });

package/tmpl/files/module.server/layers/controllers/common/crud.ejs

@@ -6,29 +6,29 @@ import CRUDActionList from "not-bulma/src/frame/crud/actions/list";
 const { notCRUD } = Frame;
 
 const MODEL_NAME = "<%- ModelName %>";
-    const modelName = notCommon.lowerFirstLetter(MODEL_NAME);
+const modelName = notCommon.lowerFirstLetter(MODEL_NAME);
 
-    const LABELS = {
+const LABELS = {
     plural: `${MODULE_NAME}:${modelName}_label_plural`,
     single: `${MODULE_NAME}:${modelName}_label_single`,
-    };
+};
 
-    Object.freeze(LABELS);
+Object.freeze(LABELS);
 
-    class nc<%- ModelName %>Common extends notCRUD {
-        static get MODULE_NAME(){
+class nc<%- ModelName %>Common extends notCRUD {
+    static get MODULE_NAME(){
         return MODULE_NAME;
-        }
+    }
 
-        static get MODEL_NAME(){
+    static get MODEL_NAME(){
         return MODEL_NAME;
-        }
+    }
 
-        static get LABELS(){
+    static get LABELS(){
         return LABELS;
-        }
+    }
 
-        constructor(app, params) {
+    constructor(app, params) {
         super(app, `${MODULE_NAME}.${MODEL_NAME}`);
         this.setModuleName(MODULE_NAME);
         this.setModelName(MODEL_NAME);
@@ -36,59 +36,61 @@ const MODEL_NAME = "<%- ModelName %>";
         this.setValidators(Validators);
         this.setOptions("params", params);
         this.setOptions("list", {
-        interface: {
-        combined: true,
-        factory: this.make.<%- modelName %>,
+            interface: {
+                combined: true,
+                factory: this.make.<%- modelName %>,
             },
             endless: false,
             preload: {},
             sorter: {
-            id: -1,
+                id: -1,
             },
             showSearch: true,
             idField: "_id",
             fields: [
-            <% if (increment) { %>
+                <% if (increment) { %>
                 {
-                path: ":<%- modelName %>ID",
+                    path: ":<%- modelName %>ID",
                     title: "ID",
                     searchable: true,
                     sortable: true,
-                    },
-                    <% } %>
-                        <% for (let fieldName of fields){ %>
-                            {
-                            path: ":<%- fieldName[0] %>",
-                                title: `${MODULE_NAME}:<%- `${modelName}_field_${fieldName[0]}_label` %>`,
-                                    searchable: true,
-                                    sortable: true,
-                                    },
-                                    <% } %>
-                                        {
-                                        path: ":_id",
-                                        title: "Действия",
-                                        type: "button",
-                                        preprocessor: (value) => CRUDActionList.createActionsButtons(this, value),
-                                        },
-                                        ],
-                                        });
+                },
+                <% } %>
+                <% for (let fieldName of fields){ %>
+                {
+                    path: ":<%- fieldName[0] %>",
+                    title: `${MODULE_NAME}:<%- `${modelName}_field_${fieldName[0]}_label` %>`,
+                    searchable: true,
+                    sortable: true,
+                },
+                <% } %>
+                {
+                    path: ":_id",
+                    title: "Действия",
+                    type: "button",
+                    preprocessor: (value) => CRUDActionList.createActionsButtons(this, value),
+                },
+            ],
+        });
+
+        this.start();
+        return this;
+    }
+
+    createDefault() {
+        let newRecord = this.getModel({
+            <% for (let fieldName of fields){ %><%- fieldName[0] %>: undefined,
+            <% } %>
+        });
+        return newRecord;
+    }
 
-                                        this.start();
-                                        return this;
-                                        }
+    static getMenu(){
+        return notCRUD.getCommonMenu(nc<%- ModelName %>Common);
+    }
 
-                                        createDefault() {
-                                        let newRecord = this.getModel({
-                                        <% for (let fieldName of fields){ %><%- fieldName[0] %>: undefined,
-                                                <% } %>
-                                                    });
-                                                    return newRecord;
-                                                    }
+}
 
-                                                    static getMenu(){
-                                                    return notCRUD.getCommonMenu(nc<%- ModelName %>Common);
-                                                        }
+export default nc<%- ModelName %>Common;
 
-                                                        }
 
-                                                        export default nc<%- ModelName %>Common;