pgkiln 0.44.0 → 0.46.0

package/src/runtime/tasks.ts

@@ -6,6 +6,7 @@ import type { Region } from '../metadata.ts';
 import { logActivity, saveState } from '../session.ts';
 import { pageAllowed } from './authz.ts';
 import { publicError, stripSemicolon, type PageContext } from './context.ts';
+import { appDateMask, appDateReader, dateField } from './items.ts';
 import { linkAttrs } from './links.ts';
 import { cell } from './report.ts';
 import { loadContext, safeNext, txContext, type Req } from './routes.ts';
@@ -158,8 +159,8 @@ async function vacationPanel(ctx: PageContext, r: Region): Promise<Raw | ''> {
     : html`<p class="muted">${t('tasks.vacation_help')}</p>
       <div class="vacation-fields">
         <label>${t('tasks.vacation_to')} <input name="to" form="${f}" maxlength="100" required autocomplete="off"></label>
-        <label>${t('tasks.vacation_from')} <input type="date" name="from" form="${f}" required></label>
-        <label>${t('tasks.vacation_until')} <input type="date" name="until" form="${f}" required></label>
+        <label>${t('tasks.vacation_from')} ${dateField(ctx, { id: `${f}_from`, iso: '', mask: appDateMask(ctx), attrs: html` name="from" form="${f}" required` })}</label>
+        <label>${t('tasks.vacation_until')} ${dateField(ctx, { id: `${f}_until`, iso: '', mask: appDateMask(ctx), attrs: html` name="until" form="${f}" required` })}</label>
         <button class="btn" form="${f}" name="action" value="set">${t('tasks.vacation_save')}</button></div>`}
   </details>`;
 }
@@ -173,7 +174,9 @@ export async function taskRoutes(app: FastifyInstance) {
     const next = safeNext(ctx.app, b.next);
     if (b.__csrf !== ctx.session.csrf_token || !['set', 'clear'].includes(String(b.action))) return reply.redirect(next, 303);
     const t = ctx.locale.t;
-    const date = (v: unknown) => (typeof v === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(v) ? v : null);
+    // (sprint 84) typed in the application's date format (or YYYY-MM-DD)
+    const readDate = appDateReader(ctx);
+    const date = (v: unknown) => (typeof v === 'string' && v.length <= 100 ? readDate(v) : null);
     try {
       await appTx(txContext(ctx), async (c) => {
         if (b.action === 'clear') await c.query('select meta.clear_vacation_rule()');

package/src/security.ts

@@ -96,7 +96,8 @@ export function securityHeaders(app: FastifyInstance) {
     // the app's own pages may use the camera (photos, scanning) and the position (location items); nothing else may
     reply.header('Permissions-Policy', 'camera=(self), microphone=(), geolocation=(self)');
     const type = String(reply.getHeader('content-type') ?? '');
-    if (type.startsWith('text/html')) {
+    // a file's own stricter policy (downloads, uploaded files: default-src 'none'; sandbox) is kept
+    if (type.startsWith('text/html') && !reply.hasHeader('content-security-policy')) {
       // No inline scripts and no inline styles: behaviour lives in /static/app.js,
       // styling in /static/app.css. The only <style> a page has (theme colours,
       // chart geometry) carries this response's nonce; style="" attributes are refused.

package/src/subscriptions.ts

@@ -219,3 +219,70 @@ export async function publish(masterId: number, kind: string, name: string, user
 
 export const unsubscribe = async (appId: number, kind: string, name: string) =>
   ((await owner.query('delete from meta.subscription where app_id = $1 and kind = $2 and name = $3', [appId, kind, name])).rowCount ?? 0) > 0;
+
+// ------------------------------------------------------------------ (105) component groups
+// A component group names some of an application's subscribable components
+// ("kind:name"); another application subscribes to all of them at once.
+
+/** The kinds a component group can hold: every subscribable kind but the theme. */
+export const GROUP_KINDS = (Object.keys(KINDS) as Kind[]).filter((k) => k !== 'theme');
+
+/** Members as the application has them ("lov:JOBS"), and a message for each that it doesn't have. */
+export async function checkGroupMembers(appId: number, members: string[]) {
+  const ok: string[] = [];
+  const problems: string[] = [];
+  for (const m of members.map((x) => x.trim()).filter(Boolean)) {
+    const at = m.indexOf(':');
+    const kind = m.slice(0, at).trim();
+    const name = m.slice(at + 1).trim();
+    if (at < 1 || !isKind(kind) || kind === 'theme') {
+      problems.push(`${m}: write kind:name, the kind one of ${GROUP_KINDS.join(', ')}.`);
+      continue;
+    }
+    const k = KINDS[kind];
+    const row = await owner.one<{ n: string }>(`select ${k.key} as n from ${k.table} where app_id = $1 and lower(${k.key}) = lower($2)`, [appId, name]);
+    if (!row) problems.push(`${m}: the application has no ${k.label.toLowerCase()} ${name}.`);
+    else if (!ok.includes(`${kind}:${row.n}`)) ok.push(`${kind}:${row.n}`);
+  }
+  return { members: ok, problems };
+}
+
+/** Component groups of the theme and library applications appId can subscribe to. */
+export async function groupsOffered(appId: number) {
+  return (
+    await owner.query<{ master_id: number; master_name: string; name: string; description: string | null; members: string[] }>(
+      `select m.id as master_id, m.name as master_name, g.name, g.description, g.members
+         from meta.component_group g join meta.app m on m.id = g.app_id
+        where m.app_type in ('theme', 'library') and m.id <> $1 and meta.app_workspace(m.id) = meta.app_workspace($1)
+        order by lower(m.name), m.id, lower(g.name)`,
+      [appId],
+    )
+  ).rows;
+}
+
+/** Subscribe appId to every member of a master's component group; members the master no longer has are skipped. */
+export async function subscribeGroup(appId: number, masterId: number, group: string, username: string) {
+  const g = await owner.one<{ members: string[] }>('select members from meta.component_group where app_id = $1 and name = $2', [masterId, group]);
+  if (!g) throw new SubscriptionError('Choose a component group.');
+  const done: string[] = [];
+  const skipped: string[] = [];
+  for (const m of g.members) {
+    const at = m.indexOf(':');
+    const kind = m.slice(0, at);
+    const name = m.slice(at + 1);
+    if (!isKind(kind) || kind === 'theme') continue;
+    const k = KINDS[kind];
+    if (!(await owner.one(`select 1 as ok from ${k.table} where app_id = $1 and ${k.key} = $2`, [masterId, name]))) {
+      skipped.push(m);
+      continue;
+    }
+    try {
+      await subscribe(appId, masterId, kind, name, username);
+      done.push(m);
+    } catch (e) {
+      if (!(e instanceof SubscriptionError)) throw e;
+      skipped.push(m);
+    }
+  }
+  return { done, skipped };
+}