prostgles-server 2.0.112 → 2.0.116

package/lib/DboBuilder.ts

@@ -447,7 +447,7 @@ export class ViewHandler {
     columns: TableSchema["columns"];
     columnsForTypes: ColumnInfo[];
     column_names: string[];
-    tableOrViewInfo: TableOrViewInfo;
+    tableOrViewInfo: TableSchema;// TableOrViewInfo;
     colSet: ColSet;
     tsColumnDefs: string[] = [];
     joins: Join[];
@@ -3151,6 +3151,12 @@ export type TableSchema = {
     })[];
     is_view: boolean;
     parent_tables: string[];
+    privileges: {
+        insert: boolean;
+        select: boolean;
+        update: boolean;
+        delete: boolean;
+    }
 }
 
 type PGConstraint = {
@@ -3185,7 +3191,37 @@ async function getConstraints(db: DB, schema: string = "public"): Promise<PGCons
 async function getTablesForSchemaPostgresSQL(db: DB, schema: string = "public"): Promise<TableSchema[]>{
     const query = 
     `
-    SELECT t.table_schema as schema, t.table_name as name 
+    SELECT jsonb_build_object(
+        'insert', EXISTS (
+            SELECT 1 
+            FROM information_schema.role_table_grants rg
+            WHERE rg.table_name = t.table_name
+            AND rg.privilege_type = 'INSERT'
+            AND rg.is_grantable = 'YES'
+        ),
+        'select', EXISTS (
+            SELECT 1 
+            FROM information_schema.role_table_grants rg
+            WHERE rg.table_name = t.table_name
+            AND rg.privilege_type = 'SELECT'
+            AND rg.is_grantable = 'YES'
+        ),
+        'update', EXISTS (
+            SELECT 1 
+            FROM information_schema.role_table_grants rg
+            WHERE rg.table_name = t.table_name
+            AND rg.privilege_type = 'UPDATE'
+            AND rg.is_grantable = 'YES'
+        ),
+        'delete', EXISTS (
+            SELECT 1 
+            FROM information_schema.role_table_grants rg
+            WHERE rg.table_name = t.table_name
+            AND rg.privilege_type = 'DELETE'
+            AND rg.is_grantable = 'YES'
+        )
+    ) as privileges
+    , t.table_schema as schema, t.table_name as name 
     , cc.table_oid as oid
     , json_agg((SELECT x FROM (
         SELECT cc.column_name as name, 
@@ -3322,7 +3358,7 @@ export function isPlainObject(o) {
     return Object(o) === o && Object.getPrototypeOf(o) === Object.prototype;
 }
 
-function postgresToTsType(udt_data_type: PG_COLUMN_UDT_DATA_TYPE): keyof typeof TS_PG_Types {
+export function postgresToTsType(udt_data_type: PG_COLUMN_UDT_DATA_TYPE): keyof typeof TS_PG_Types {
     return Object.keys(TS_PG_Types).find(k => {
         return TS_PG_Types[k].includes(udt_data_type) || !TS_PG_Types[k].length;
     }) as keyof typeof TS_PG_Types;

package/lib/Prostgles.ts

@@ -1093,20 +1093,25 @@ type DboTableCommand = Request & DboTable & {
 const RULE_TO_METHODS = [
     { 
         rule: "getColumns",
+        sqlRule: "select",
         methods: ["getColumns"], 
         no_limits: true, 
         allowed_params: [],
+        table_only: false,
         hint: ` expecting false | true | undefined`
     },
     { 
         rule: "getInfo",
+        sqlRule: "select",
         methods: ["getInfo"], 
         no_limits: true, 
         allowed_params: [],
+        table_only: false,
         hint: ` expecting false | true | undefined`
     },
    { 
        rule: "insert",
+       sqlRule: "insert",
        methods: ["insert", "upsert"], 
        no_limits: <SelectRule>{ fields: "*" }, 
        table_only: true,
@@ -1115,6 +1120,7 @@ const RULE_TO_METHODS = [
     },
    { 
        rule: "update", 
+       sqlRule: "update",
        methods: ["update", "upsert", "updateBatch"], 
        no_limits: <UpdateRule>{ fields: "*", filterFields: "*", returningFields: "*"  },
        table_only: true, 
@@ -1123,13 +1129,16 @@ const RULE_TO_METHODS = [
     },
    { 
        rule: "select", 
+       sqlRule: "select",
        methods: ["findOne", "find", "count"], 
        no_limits: <SelectRule>{ fields: "*", filterFields: "*" }, 
+       table_only: false,
        allowed_params: <Array<keyof SelectRule>>["fields", "filterFields", "forcedFilter", "validate", "maxLimit"] ,
        hint: ` expecting "*" | true | { fields: ( string | string[] | {} )  }`
     },
    { 
        rule: "delete", 
+       sqlRule: "delete",
        methods: ["delete", "remove"], 
        no_limits: <DeleteRule>{ filterFields: "*" } , 
        table_only: true,
@@ -1137,20 +1146,24 @@ const RULE_TO_METHODS = [
        hint: ` expecting "*" | true | { filterFields: ( string | string[] | {} ) } \n Will use "select", "update", "delete" and "insert" rules`
     },
     { 
-       rule: "sync", methods: ["sync", "unsync"], 
+       rule: "sync", 
+       sqlRule: "select",
+       methods: ["sync", "unsync"], 
        no_limits: null,
        table_only: true,
        allowed_params: <Array<keyof SyncRule>>["id_fields", "synced_field", "sync_type", "allow_delete", "throttle", "batch_size"],
        hint: ` expecting "*" | true | { id_fields: string[], synced_field: string }`
     },
     { 
-        rule: "subscribe", methods: ["unsubscribe", "subscribe", "subscribeOne"], 
+        rule: "subscribe", 
+        sqlRule: "select",
+        methods: ["unsubscribe", "subscribe", "subscribeOne"], 
         no_limits: <SubscribeRule>{  throttle: 0  },
         table_only: true,
         allowed_params: <Array<keyof SubscribeRule>>["throttle"],
         hint: ` expecting "*" | true | { throttle: number } \n Will use "select" rules`
     }
-];
+] as const;
 // const ALL_PUBLISH_METHODS = ["update", "upsert", "delete", "insert", "find", "findOne", "subscribe", "unsubscribe", "sync", "unsync", "remove"];
 // const ALL_PUBLISH_METHODS = RULE_TO_METHODS.map(r => r.methods).flat();
 
@@ -1239,7 +1252,7 @@ export class PublishParser {
 
         if(!command || !tableName) throw "command OR tableName are missing";
 
-        let rtm = RULE_TO_METHODS.find(rtms => rtms.methods.includes(command));
+        let rtm = RULE_TO_METHODS.find(rtms => (rtms.methods as any).includes(command));
         if(!rtm){
             throw "Invalid command: " + command;
         }
@@ -1285,7 +1298,9 @@ export class PublishParser {
             let table_rules = _publish[tableName];// applyParamsIfFunc(_publish[tableName],  localParams, this.dbo, this.db, user);
 
             /* Get view or table specific rules */
-            const is_view = (this.dbo[tableName] as TableHandler | ViewHandler).is_view,
+            const tHandler = (this.dbo[tableName] as TableHandler | ViewHandler);
+            
+            const is_view = tHandler.is_view,
                 MY_RULES = RULE_TO_METHODS.filter(r => !is_view || !r.table_only);
 
             // if(tableName === "various") console.warn(1033, MY_RULES)
@@ -1295,7 +1310,14 @@ export class PublishParser {
                 if([true, "*"].includes(table_rules as any)){
                     table_rules = {};
                     MY_RULES.map(r => {
-                        table_rules[r.rule] = { ...r.no_limits };
+                        /** Check PG User privileges */
+                        if(
+                            tHandler.tableOrViewInfo.privileges[r.sqlRule]
+                        ){
+                            table_rules[r.rule] = { ...r.no_limits };
+                        }
+                        
+
                     });
                     // if(tableName === "various") console.warn(1042, table_rules)
                 }
@@ -1315,7 +1337,7 @@ export class PublishParser {
 
                     if(table_rules[r.rule]){
                         /* Add implied methods if not falsy */
-                        r.methods.map(method => {
+                        (r.methods as any).map(method => {
                             if(table_rules[method] === undefined){
                                 const publishedTable = (table_rules as PublishTable);
                                 if(method === "updateBatch" && !publishedTable.update){
@@ -1340,11 +1362,17 @@ export class PublishParser {
                     
                     ruleKeys.filter(m => table_rules[m])
                         .find(method => {
-                            let rm = MY_RULES.find(r => r.rule === method || r.methods.includes(method));
+                            let rm = MY_RULES.find(r => r.rule === method || (r.methods as any).includes(method));
                             if(!rm){
                                 throw `Invalid rule in publish.${tableName} -> ${method} \nExpecting any of: ${flat(MY_RULES.map(r => [r.rule, ...r.methods])).join(", ")}`;
                             }
 
+                            /** Check user privileges */
+                            if(!tHandler.tableOrViewInfo.privileges[rm.sqlRule]){
+                                delete table_rules[method];
+                                return;
+                            }
+
                             /* Check RULES for invalid params */
                             /* Methods do not have params -> They use them from rules */
                             if(method === rm.rule){

package/lib/QueryBuilder.ts

@@ -4,7 +4,7 @@
  *  Licensed under the MIT License. See LICENSE in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 
-import { pgp, Filter, LocalParams, isPlainObject, TableHandler, ViewHandler } from "./DboBuilder";
+import { pgp, Filter, LocalParams, isPlainObject, TableHandler, ViewHandler, postgresToTsType } from "./DboBuilder";
 import { TableRule, flat } from "./Prostgles";
 import { SelectParamsBasic as SelectParams, isEmpty, FieldFilter, asName, TextFilter_FullTextSearchFilterKeys, TS_PG_Types, ColumnInfo } from "prostgles-types";
 import { get } from "./utils";
@@ -694,28 +694,49 @@ export const FUNCTIONS: FunctionSpec[] = [
       if(returnType === "index"){ 
         res = `CASE WHEN position(${term} IN ${col}) > 0 THEN position(${term} IN ${col}) - 1 ELSE -1 END`;
 
-      } else if(returnType === "boolean"){
-        res = `CASE WHEN position(${term} IN ${col}) > 0 THEN TRUE ELSE FALSE END`;
+      // } else if(returnType === "boolean"){
+      //   res = `CASE WHEN position(${term} IN ${col}) > 0 THEN TRUE ELSE FALSE END`;
 
-      } else if(returnType === "object"){
+      } else if(returnType === "object" || returnType === "boolean"){
+        const hasChars = Boolean(term &&  /[a-z]/i.test(term));
         res = `CASE 
           ${cols.map(c => {
             const colInfo = allColumns.find(ac => ac.name === c);
-            const colNameEscaped = asNameAlias(c, tableAlias)
+            return {
+              key: c,
+              colInfo
+            }
+          }).filter(c => 
+            /** Exclude numeric columns when the search tern contains a character */
+            !hasChars ||  
+            c.colInfo?.udt_name && 
+            postgresToTsType(c.colInfo.udt_name) !== "number"
+          )
+          .map(c => {
+            const colNameEscaped = asNameAlias(c.key, tableAlias)
             let colSelect = `${colNameEscaped}::TEXT`;
-            if(colInfo?.udt_name.startsWith("timestamp")){
-              colSelect = `( CASE WHEN ${colNameEscaped} IS NULL THEN '' ELSE concat_ws(' ', 
+            const isTstamp = c.colInfo?.udt_name.startsWith("timestamp");
+            if(isTstamp || c.colInfo?.udt_name === "date"){
+              colSelect = `( CASE WHEN ${colNameEscaped} IS NULL THEN '' 
+              ELSE concat_ws(' ', 
               ${colNameEscaped}::TEXT, 
-                to_char(${colNameEscaped}, 'Day Month '), 
-                'Q' || to_char(${colNameEscaped}, 'Q'),
-                'WK' || to_char(${colNameEscaped}, 'WW')
+              ${isTstamp? `'TZ' || trim(to_char(${colNameEscaped}, 'OF')), `: ''}
+                trim(to_char(${colNameEscaped}, 'Day Month')), 
+                'Q' || trim(to_char(${colNameEscaped}, 'Q')),
+                'WK' || trim(to_char(${colNameEscaped}, 'WW'))
               ) END)`
             }
             let colTxt = `COALESCE(${colSelect}, '')`; //  position(${term} IN ${colTxt}) > 0
+            if(returnType === "boolean"){
+              return ` 
+                WHEN  ${colTxt} ${matchCase? "LIKE" : "ILIKE"} ${asValue('%' + rawTerm + '%')}
+                  THEN TRUE
+                `
+            }
             return ` 
               WHEN  ${colTxt} ${matchCase? "LIKE" : "ILIKE"} ${asValue('%' + rawTerm + '%')}
                 THEN json_build_object(
-                  ${asValue(c)}, 
+                  ${asValue(c.key)}, 
                   ${makeTextMatcherArray(
                     colTxt, 
                     term
@@ -723,7 +744,7 @@ export const FUNCTIONS: FunctionSpec[] = [
                 )::jsonb
               `
           }).join(" ")}
-          ELSE NULL
+          ELSE ${(returnType === "boolean")? "FALSE" : "NULL"}
 
         END`;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prostgles-server",
-  "version": "2.0.112",
+  "version": "2.0.116",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/tests/client/PID.txt

@@ -1 +1 @@
-6272
+18519

package/tests/server/package-lock.json

@@ -23,7 +23,7 @@
     },
     "../..": {
       "name": "prostgles-server",
-      "version": "2.0.111",
+      "version": "2.0.115",
       "license": "MIT",
       "dependencies": {
         "@aws-sdk/client-s3": "^3.32.0",