nuxeo-development-framework 5.6.3 → 5.6.4

package/src/lib/shared/evaluator/evaluator.ts

@@ -0,0 +1,385 @@
+import _, { get, keys, set, trim, values } from 'lodash';
+import stringHash from 'string-hash';
+
+import { EvaluatorOptions, TemplateSettings } from './types';
+
+/**
+ * Creates a secure context for function evaluation that prevents access to the window object.
+ * @returns {Record<string, any>} A secure context object with safe properties.
+ */
+function createSecureContext(): Record<string, any> {
+	// Create a secure context with only safe properties
+	return {
+		// Add any safe globals here that should be accessible
+		console: {
+			log: console.log,
+			warn: console.warn,
+			error: console.error
+		},
+		// Add other safe objects/functions as needed
+		Math,
+		Date,
+		Number,
+		String,
+		Boolean,
+		Array,
+		Object,
+		JSON,
+		// Prevent access to window
+		window: undefined,
+		self: undefined,
+		globalThis: undefined,
+		_: _ // Include lodash if needed, but ensure it's used safely
+	};
+}
+
+/**
+ * A utility class for evaluating expressions, interpolating strings, and working with templates.
+ * This class provides static methods for dynamic evaluation of code, string interpolation,
+ * and template processing with caching capabilities.
+ */
+export class Evaluator {
+	/**
+	 * Cache for storing compiled template functions to improve performance.
+	 * Keys are string hashes of the template, values are the compiled functions.
+	 */
+	static cache: Record<string, Function> = {};
+
+	/**
+	 * Settings for template processing, defining regex patterns for different template operations.
+	 * - interpolate: Pattern for variable interpolation ({{ variable }})
+	 * - evaluate: Pattern for code evaluation ({% code %})
+	 * - escape: Pattern for HTML escaping ({{{ variable }}})
+	 */
+	static templateSettings: TemplateSettings = {
+		interpolate: /{{([\s\S]+?)}}/g,
+		evaluate: /\{%([\s\S]+?)%\}/g,
+		escape: /\{\{\{([\s\S]+?)\}\}\}/g
+	};
+
+	/**
+	 * Creates a function from a string or returns the function if already provided.
+	 * Uses a secure context to prevent access to the window object by default.
+	 * @param {string|Function} func - The function or string to convert to a function.
+	 * @param {...any} params - The parameters to pass to the function.
+	 * @param {EvaluatorOptions} [options={}] - Optional configuration for the evaluation.
+	 * @returns {Function} - The resulting function.
+	 */
+	static evaluator(func: string | Function, ...params: any[]): Function {
+		// Extract options if the last parameter is an options object
+		let options: EvaluatorOptions = {};
+		if (
+			params.length > 0 &&
+			params[params.length - 1] &&
+			typeof params[params.length - 1] === 'object' &&
+			'securityMode' in params[params.length - 1]
+		) {
+			options = params.pop() as EvaluatorOptions;
+		}
+
+		if (typeof func === 'function') {
+			return func;
+		}
+
+		if (typeof params[0] === 'object') {
+			params = keys(params[0]);
+		}
+
+		// Check if we should use secure mode (default) or unsafe mode
+		const securityMode = options.securityMode || 'secure';
+
+		if (securityMode === 'unsafe') {
+			// In unsafe mode, create a function with access to all globals
+			return new Function(...params, func as string);
+		}
+		const sandbox = createSecureContext();
+		const sandboxKeys = Object.keys(sandbox);
+		const sandboxAssignments = sandboxKeys.map((key) => `const ${key} = sandbox.${key};`).join('');
+
+		const wrapper = new Function(...params, 'sandbox', `${sandboxAssignments}${func as string}`);
+
+		return (...args: any[]) => wrapper(...args, sandbox);
+	}
+
+	/**
+	 * Replaces template expressions in a string with values from data.
+	 * Supports function calls within templates and fallback values using || syntax.
+	 * By default, ensures evaluation happens in a secure context to prevent access to window object.
+	 * @param {string} rawTemplate - The template string containing expressions to interpolate.
+	 * @param {Record<string, any>} data - The data object containing values to use for interpolation.
+	 * @param {EvaluatorOptions} [options={}] - Optional configuration for the interpolation process.
+	 * @returns {string} - The interpolated string with all expressions replaced with actual values.
+	 */
+	static interpolateString(rawTemplate: string, data: Record<string, any>, options: EvaluatorOptions = {}): string {
+		if (!rawTemplate) {
+			return '';
+		}
+		if (typeof rawTemplate !== 'string') {
+			return (rawTemplate as any).toString();
+		}
+
+		// Check if we should use secure mode (default) or unsafe mode
+		const securityMode = options.securityMode || 'secure';
+
+		// Create a secure data object if needed
+		const secureData =
+			securityMode === 'unsafe'
+				? data
+				: {
+						...createSecureContext(),
+						...data,
+						// Ensure these remain undefined
+						window: undefined,
+						self: undefined,
+						globalThis: undefined
+					};
+
+		return rawTemplate.replace(/({{\s*(.*?)\s*}})/g, (match: string, $1: string, expression: string) => {
+			if (expression.indexOf('(') !== -1) {
+				return expression.replace(/([^(]+)\(([^)]+)\s*\);?/, (_: string, fnName: string, argsStr: string) => {
+					fnName = trim(fnName);
+					const func = get(secureData, fnName);
+
+					if (func) {
+						if (argsStr) {
+							const args = argsStr.split(',').map((arg: string) => {
+								const trimmed = trim(arg);
+								if (/^['"]/.test(trimmed)) return trimmed.slice(1, -1);
+								return get(secureData, trimmed);
+							});
+							return Evaluator.evaluate(func, args, '', false, secureData, options);
+						}
+						return Evaluator.evaluate(func, [], '', false, secureData, options);
+					}
+					return '';
+				});
+			} else {
+				let dataPath = expression;
+				if (expression.indexOf('?') !== -1) {
+					dataPath = expression.replace(/\?\./g, '.');
+				}
+				const parts = dataPath.split('||').map((item: string) => item.trim());
+				let value = '';
+				let path = '';
+				for (let i = 0; i < parts.length; i++) {
+					path = parts[i];
+					if (_.has(secureData, path)) {
+						value = _.get(secureData, path);
+						break;
+					}
+				}
+				if (options.data) {
+					set(options.data, path, value);
+				}
+				return value;
+			}
+		});
+	}
+
+	/**
+	 * Performs an evaluation using the evaluation context of this component.
+	 * By default, ensures evaluation happens in a secure context to prevent access to window object.
+	 * @param {string|Function|object} func - The function or string to evaluate.
+	 * @param {object} args - The arguments to pass to the evaluation.
+	 * @param {string} ret - The name of the variable within the evaluation context to return.
+	 * @param {boolean} interpolate - Determines if it should replace all {{ }} token references with actual data.
+	 * @param {object} context -   - The evaluation context.
+	 * @param {EvaluatorOptions } options - The options to pass to the evaluation.
+	 * @returns {*} - The result of the evaluation.
+	 */
+	static evaluate(
+		func: any,
+		args: Record<string, any> = {},
+		ret: string = 'show',
+		interpolate: boolean = false,
+		context: Record<string, any> = {},
+		options: EvaluatorOptions = {}
+	): any {
+		let returnVal = null;
+
+		const field = args.field ? args.field : { key: 'unknown' };
+		const fieldKey = field.key;
+
+		if (typeof func === 'string') {
+			if (ret) {
+				func = `var ${ret};${func};return ${ret}`;
+			}
+
+			if (interpolate) {
+				func = Evaluator.interpolate(func, args, options);
+			}
+
+			try {
+				// Pass the security mode option to the evaluator
+				const evaluatorOptions = { securityMode: options.securityMode || 'secure' };
+				func = Evaluator.evaluator(func, args, context, evaluatorOptions);
+				args = Array.isArray(args) ? args : values(args);
+			} catch (err) {
+				console.warn(`An error occured within the custom function for ${fieldKey}`, err);
+				returnVal = null;
+				func = false;
+			}
+		}
+
+		if (typeof func === 'function') {
+			try {
+				returnVal = Evaluator.execute(func, args, context, options);
+			} catch (err) {
+				returnVal = null;
+				console.warn(`An error occured within custom function for ${fieldKey}`, err);
+			}
+		} else if (func) {
+			console.warn(`Unknown function type for ${fieldKey}`);
+		}
+		return returnVal;
+	}
+
+	/**
+	 * Executes a function with provided arguments and context.
+	 * By default, ensures execution happens in a secure context to prevent access to window object.
+	 * @param {Function} func - The function to execute.
+	 * @param {any[]|Record<string, any>} args - The arguments to pass to the function, either as an array or object.
+	 * @param {Record<string, any>} [context={}] - The context (this) to use when executing the function.
+	 * @param {EvaluatorOptions} [options={}] - Optional configuration for the execution.
+	 * @returns {any} - The result of the function execution.
+	 */
+	static execute(
+		func: Function,
+		args: any[] | Record<string, any>,
+		context: Record<string, any> = {},
+		options: EvaluatorOptions = {}
+	): any {
+		// Check if we should use secure mode (default) or unsafe mode
+		const securityMode = options.securityMode || 'secure';
+
+		if (securityMode === 'unsafe') {
+			// In unsafe mode, execute with the original context
+			return Array.isArray(args) ? func.apply(context, args) : func.call(context, args);
+		} else {
+			// In secure mode, create a secure context by merging the provided context with our secure context
+			const secureContext = {
+				...createSecureContext(),
+				...context,
+				// Ensure these remain undefined even if they were in the provided context
+				window: undefined,
+				self: undefined,
+				globalThis: undefined
+			};
+
+			// Execute the function with the secure context
+			return Array.isArray(args) ? func.apply(secureContext, args) : func.call(secureContext, args);
+		}
+	}
+
+	/**
+	 * Creates a template function from a string with caching for performance.
+	 * By default, ensures the template function executes in a secure context.
+	 * @param {string} template - The template string to compile into a function.
+	 * @param {string} [hash] - Optional hash to use as cache key. If not provided, a hash will be generated from the template.
+	 * @param {EvaluatorOptions} [options={}] - Optional configuration for the template.
+	 * @returns {Function|undefined} - The compiled template function, or undefined if compilation fails.
+	 */
+	static template(template: string, hash?: string, options: EvaluatorOptions = {}): Function | undefined {
+		hash = hash || stringHash(template).toString();
+
+		// If hash contains options object, extract it
+		if (typeof hash === 'object' && 'securityMode' in hash) {
+			options = hash as unknown as EvaluatorOptions;
+			hash = stringHash(template).toString();
+		}
+
+		// Check if we have a cached version
+		const cacheKey = hash + (options.securityMode || 'secure');
+		if (Evaluator.cache[cacheKey]) {
+			return Evaluator.cache[cacheKey];
+		}
+
+		try {
+			template = template.replace(/ctx\./g, '');
+
+			// Create the template function using lodash
+			const templateFunc = _.template(template, Evaluator.templateSettings);
+
+			// Check if we should use secure mode (default) or unsafe mode
+			const securityMode = options.securityMode || 'secure';
+
+			if (securityMode === 'unsafe') {
+				// In unsafe mode, return the original template function
+				return (Evaluator.cache[cacheKey] = templateFunc);
+			} else {
+				// In secure mode, wrap the template function to ensure it runs in a secure context
+				const secureTemplateFunc = (data: any) => {
+					// Create a secure context for the template
+					const secureData = {
+						...createSecureContext(),
+						...data,
+						// Ensure these remain undefined
+						window: undefined,
+						self: undefined,
+						globalThis: undefined
+					};
+
+					return templateFunc(secureData);
+				};
+
+				// Cache and return the secure template function
+				return (Evaluator.cache[cacheKey] = secureTemplateFunc);
+			}
+		} catch (err) {
+			console.warn('Error while processing template', err, template);
+			return undefined;
+		}
+	}
+
+	/**
+	 * Interpolates a template with data, handling both function templates and string templates.
+	 * By default, ensures interpolation happens in a secure context to prevent access to window object.
+	 * @param {string|Function} rawTemplate - The template to interpolate, either as a string or a function.
+	 * @param {Record<string, any>} data - The data object to use for interpolation.
+	 * @param {EvaluatorOptions} options - Options for the interpolation process.
+	 * @returns {string|any} - The result of the interpolation, typically a string but could be any type depending on the template.
+	 */
+	static interpolate(
+		rawTemplate: string | Function,
+		data: Record<string, any>,
+		options: EvaluatorOptions = {}
+	): string | any {
+		if (typeof rawTemplate === 'function') {
+			try {
+				// If the template is a function, execute it with the data
+				// We can't directly secure a provided function, but we can use execute
+				// to run it in a secure context if needed
+				if (options.securityMode !== 'unsafe') {
+					const secureData = {
+						...createSecureContext(),
+						...data,
+						window: undefined,
+						self: undefined,
+						globalThis: undefined
+					};
+					return rawTemplate(secureData);
+				} else {
+					return rawTemplate(data);
+				}
+			} catch (err) {
+				console.warn('Error interpolating template', err, data);
+				return (err as Error).message;
+			}
+		}
+
+		rawTemplate = String(rawTemplate);
+		// Pass the security mode option to the template method
+		const template = Evaluator.template(rawTemplate, undefined, options);
+
+		if (typeof template === 'function') {
+			try {
+				return template(data);
+			} catch (err) {
+				console.warn('Error interpolating template', err, rawTemplate, data);
+				return (err as Error).message;
+			}
+		}
+
+		return template;
+	}
+}

package/src/lib/shared/evaluator/index.ts

@@ -0,0 +1,2 @@
+export * from './evaluator';
+export * from './types'

package/src/lib/shared/evaluator/types.ts

@@ -0,0 +1,21 @@
+export type EvaluatorOptions = {
+	data?: Record<string, any>;
+	/**
+	 * Controls the security level of evaluation.
+	 * - 'secure' (default): Prevents access to window object and other global objects
+	 * - 'unsafe': Allows access to all global objects (use with caution)
+	 */
+	securityMode?: 'secure' | 'unsafe';
+};
+
+export type TemplateSettings = {
+	interpolate: RegExp;
+	evaluate: RegExp;
+	escape: RegExp;
+};
+
+export type InterpolateString = `${string}{{${string | number}}}${string}`;
+
+export type EvaluatedString<VAR extends string = 'show'> = `${string}${VAR}${Whitespace}=${Whitespace}${string}`;
+
+type Whitespace = '' | ' ' | `${any}`;

package/src/lib/shared/index.ts

@@ -0,0 +1,7 @@
+export * from './directives';
+export * from './services';
+export * from './components';
+export * from './models';
+export * from './libraryShared.module';
+export * from './evaluator'
+export * from './constants'

package/src/lib/shared/libraryShared.module.ts

@@ -0,0 +1,61 @@
+import { NgModule } from '@angular/core';
+import { CommonModule } from '@angular/common';
+import { TranslateModule } from '@ngx-translate/core';
+import { ReadMoreComponent } from './components/read-more/read-more.component';
+import { UserCardComponent } from './components/user-card/user-card.component';
+import { AvatarModule } from '../components/avatar/avatar.module';
+import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
+import { ButtonComponent } from './components/button/button.component';
+import { NoDataComponent } from './components/no-data/no-data.component';
+import { SpinnerComponent } from './components/spinner/spinner.component';
+import { MatIconModule } from '@angular/material/icon';
+import { MatListModule } from '@angular/material/list';
+import { MatMenuModule } from '@angular/material/menu';
+import { AutocompleteLibModule } from 'angular-ng-autocomplete';
+import { ItemListComponent } from './components/item-list/item-list.component';
+import { RouterModule } from '@angular/router';
+import { DirectiveModule } from '../directive/directive.module';
+import { MatTooltipModule } from '@angular/material/tooltip';
+import { ElementHeightModule, FluidHeightModule } from './directives';
+
+/**
+ * @title
+ * Shared UI Components
+ */
+@NgModule({
+	declarations: [
+		ReadMoreComponent,
+		UserCardComponent,
+		ButtonComponent,
+		NoDataComponent,
+		SpinnerComponent,
+		ItemListComponent
+	],
+	imports: [
+		AvatarModule,
+		CommonModule,
+		RouterModule,
+		TranslateModule,
+		MatProgressSpinnerModule,
+		MatIconModule,
+		MatListModule,
+		MatMenuModule,
+		AutocompleteLibModule,
+		DirectiveModule,
+		MatTooltipModule,
+		FluidHeightModule,
+		ElementHeightModule
+	],
+	exports: [
+		UserCardComponent,
+		ReadMoreComponent,
+		TranslateModule,
+		ButtonComponent,
+		NoDataComponent,
+		SpinnerComponent,
+		ItemListComponent,
+		FluidHeightModule,
+		ElementHeightModule
+	]
+})
+export class LibrarySharedModule {}

package/src/lib/shared/models/index.ts

@@ -0,0 +1,5 @@
+export * from './mapper/index';
+export * from './nuxeo-response.model';
+export * from './task.model';
+export * from './ndf-request.model';
+export * from './type-helpers'

package/src/lib/shared/models/mapper/nuxeo-mapper.ts

@@ -0,0 +1,40 @@
+export class NuxeoMapper {
+	static schemaToModel<Schemas extends Record<string, any>>(
+		properties: Record<string, any>
+	): { [K in keyof Schemas]: Schemas[K] } {
+		const mappedProperties: Partial<{
+			[K in keyof Schemas]: Partial<Schemas[K]>;
+		}> = {};
+		for (const key in properties) {
+			if (properties.hasOwnProperty(key)) {
+				const [prefix, propertyKey] = key.split(':');
+				if (!mappedProperties[prefix as keyof Schemas]) {
+					mappedProperties[prefix as keyof Schemas] = {} as Partial<
+						Schemas[keyof Schemas]
+					>;
+				}
+				(mappedProperties[prefix as keyof Schemas] as any)[propertyKey] =
+					properties[key];
+			}
+		}
+		return mappedProperties as { [K in keyof Schemas]: Schemas[K] };
+	}
+
+	static modelToSchema<Schemas extends Record<string, any>>(model: {
+		[K in keyof Schemas]: Schemas[K];
+	}): Record<string, any> {
+		const packedProperties: Record<string, any> = {};
+		for (const schemaKey in model) {
+			if (model.hasOwnProperty(schemaKey)) {
+				const schemaProperties = model[schemaKey];
+				for (const propertyKey in schemaProperties) {
+					if (schemaProperties.hasOwnProperty(propertyKey)) {
+						packedProperties[`${schemaKey}:${propertyKey}`] =
+							schemaProperties[propertyKey];
+					}
+				}
+			}
+		}
+		return packedProperties;
+	}
+}

package/src/lib/shared/models/ndf-request.model.ts

@@ -0,0 +1,7 @@
+export type NdfRequestModel = {
+	method: 'post' | 'get' | 'put' | 'delete';
+	url: string;
+	payload?: Record<string, any>;
+	params?: Record<string, any>;
+	headers?: Record<string, any>;
+};

package/src/lib/shared/models/nuxeo-response.model.ts

@@ -0,0 +1,61 @@
+export const ENTITY_TYPE = 'entity-type';
+export interface NuxeoQuickFilter {
+	name: string;
+	active: boolean;
+}
+export interface NuxeoPagination<T> {
+	[ENTITY_TYPE]: string;
+	isPaginable: boolean;
+	resultsCount: number;
+	pageSize: number;
+	maxPageSize: number;
+	resultsCountLimit: number;
+	currentPageSize: number;
+	currentPageIndex: number;
+	currentPageOffset: number;
+	numberOfPages: number;
+	isPreviousPageAvailable: boolean;
+	isNextPageAvailable: boolean;
+	isLastPageAvailable: boolean;
+	isSortable: boolean;
+	hasError: boolean;
+	errorMessage: string | null;
+	totalSize: number;
+	pageIndex: number;
+	pageCount: number;
+	quickFilters: NuxeoQuickFilter[];
+	aggregations?: Record<string, any>;
+	entries: T[];
+}
+export interface NuxeoResponse {
+	[ENTITY_TYPE]: string;
+	entries: Entity[];
+}
+export type Entity = {
+	[ENTITY_TYPE]: string;
+	repository?: string;
+	uid?: string;
+	path?: string;
+	type?: string;
+	state?: string;
+	parentRef?: string | null;
+	isCheckedOut?: boolean;
+	isRecord?: boolean;
+	retainUntil?: string | null;
+	hasLegalHold?: boolean;
+	isUnderRetentionOrLegalHold?: boolean;
+	isVersion?: boolean;
+	isProxy?: boolean;
+	changeToken?: string;
+	contextParameters?: Record<string, any>;
+	isTrashed?: boolean;
+	title?: string;
+	lastModified?: string;
+	properties?: Record<string, any>;
+	facets?: string[];
+	schemas?: Schema[];
+};
+export interface Schema {
+	name: string;
+	prefix: string;
+}

package/src/lib/shared/models/task.model.ts

@@ -0,0 +1,76 @@
+import { Entity, ENTITY_TYPE } from './nuxeo-response.model';
+
+export interface Task {
+	[ENTITY_TYPE]?: string;
+	id?: string;
+	name?: string;
+	workflowInstanceId?: string;
+	workflowModelName?: string;
+	workflowInitiator?: string;
+	workflowTitle?: string;
+	workflowLifeCycleState?: string;
+	graphResource?: string;
+	state?: string;
+	directive?: any;
+	created?: string;
+	dueDate?: string;
+	nodeName?: string;
+	targetDocumentIds?: Entity[];
+	actors?: Actor[];
+	delegatedActors?: any[];
+	comments?: any[];
+	variables?: Record<string, any>;
+	taskInfo?: TaskInfo;
+	workflowInitiatorDetails?: WorkflowInitiatorDetails;
+	actorsDetails?: Record<string, any>[];
+	customTaskVariables?: Record<string, any>;
+	workflowVariables?: Record<string, any>;
+}
+
+export interface Actor {
+	id?: string;
+	[ENTITY_TYPE]?: string;
+	properties?: BaseProperties;
+	extendedGroups?: any[];
+	isPartial?: boolean;
+	isAdministrator?: boolean;
+	isAnonymous?: boolean;
+	birthdate?: any;
+	phonenumber?: any;
+	avatar?: any;
+	userGroups?: BaseModel[];
+	fullName?: string;
+}
+
+export interface WorkflowInitiatorDetails {
+	properties?: BaseProperties;
+	fullName?: string;
+	birthdate?: any;
+	phonenumber?: any;
+	avatar?: any;
+}
+
+export interface TaskInfo {
+	allowTaskReassignment?: boolean;
+	taskActions?: BaseModel[];
+	layoutResource?: BaseModel;
+	schemas?: BaseModel[];
+}
+
+interface BaseModel {
+	name?: string;
+	url?: string;
+	label?: string;
+	validate?: boolean;
+}
+
+interface BaseProperties {
+	firstName?: string;
+	lastName?: string;
+	jobTitle?: any;
+	tenantId?: any;
+	groups?: string[];
+	company?: any;
+	email?: string;
+	username?: string;
+}

package/src/lib/shared/models/type-helpers.ts

@@ -0,0 +1,15 @@
+// ----------------------------
+// Basic Utility Types
+// ----------------------------
+export type StringOrNumber = string | number;
+export type StrictOmit<K, T extends keyof K> = Omit<K, T>;
+export type LocalizedValue = { ar: string; en: string };
+export type Prettify<T> = {
+	[k in keyof T]: T[k];
+} & {};
+
+// ----------------------------
+// Special String Types
+// ----------------------------
+
+export type TranslateKey = string;