prostgles-server 4.2.183 → 4.2.185

package/lib/PublishParser/PublishParser.ts

@@ -1,4 +1,4 @@
-import { Method, isObject } from "prostgles-types";
+import { Method, getObjectEntries, isObject } from "prostgles-types";
 import { AuthResult, SessionUser } from "../Auth/AuthTypes";
 import { LocalParams } from "../DboBuilder/DboBuilder";
 import { DB, DBHandlerServer, Prostgles } from "../Prostgles";
@@ -6,17 +6,33 @@ import { VoidFunction } from "../SchemaWatch/SchemaWatch";
 import { getFileTableRules } from "./getFileTableRules";
 import { getSchemaFromPublish } from "./getSchemaFromPublish";
 import { getTableRulesWithoutFileTable } from "./getTableRulesWithoutFileTable";
-import { DboTable, DboTableCommand, ParsedPublishTable, PublishMethods, PublishObject, PublishParams, RULE_TO_METHODS, TableRule } from "./publishTypesAndUtils";
+import {
+  DboTable,
+  DboTableCommand,
+  ParsedPublishTable,
+  PublishMethods,
+  PublishObject,
+  PublishParams,
+  RULE_TO_METHODS,
+  TableRule,
+} from "./publishTypesAndUtils";
 
 export class PublishParser {
   publish: any;
   publishMethods?: PublishMethods<void, SessionUser> | undefined;
   publishRawSQL?: any;
   dbo: DBHandlerServer;
-  db: DB
+  db: DB;
   prostgles: Prostgles;
 
-  constructor(publish: any, publishMethods: PublishMethods<void, SessionUser> | undefined, publishRawSQL: any, dbo: DBHandlerServer, db: DB, prostgles: Prostgles) {
+  constructor(
+    publish: any,
+    publishMethods: PublishMethods<void, SessionUser> | undefined,
+    publishRawSQL: any,
+    dbo: DBHandlerServer,
+    db: DB,
+    prostgles: Prostgles
+  ) {
     this.publish = publish;
     this.publishMethods = publishMethods;
     this.publishRawSQL = publishRawSQL;
@@ -27,32 +43,42 @@ export class PublishParser {
     if (!this.dbo || !this.publish) throw "INTERNAL ERROR: dbo and/or publish missing";
   }
 
-  async getPublishParams(localParams: LocalParams, clientInfo?: AuthResult): Promise<PublishParams> {
-    if (!this.dbo) throw "dbo missing"
+  async getPublishParams(
+    localParams: LocalParams,
+    clientInfo?: AuthResult
+  ): Promise<PublishParams> {
+    if (!this.dbo) throw "dbo missing";
     return {
-      ...(clientInfo || await this.prostgles.authHandler?.getClientInfo(localParams)),
+      ...(clientInfo || (await this.prostgles.authHandler?.getClientInfo(localParams))),
       dbo: this.dbo as any,
       db: this.db,
       socket: localParams.socket!,
       tables: this.prostgles.dboBuilder.tables,
-    }
+    };
   }
 
-  async getAllowedMethods(reqInfo: Pick<LocalParams, "httpReq" | "socket">, userData?: AuthResult): Promise<{ [key: string]: Method; }> {
-    const methods: { [key: string]: Method; } = {};
+  async getAllowedMethods(
+    reqInfo: Pick<LocalParams, "httpReq" | "socket">,
+    userData?: AuthResult
+  ): Promise<{ [key: string]: Method }> {
+    const methods: { [key: string]: Method } = {};
 
     const publishParams = await this.getPublishParams(reqInfo, userData);
     const _methods = await applyParamsIfFunc(this.publishMethods, publishParams);
 
     if (_methods && Object.keys(_methods).length) {
-      Object.entries(_methods).map(([key, method]) => {
-        const isFuncLike = (maybeFunc: VoidFunction | Promise<void>) => (typeof maybeFunc === "function" || maybeFunc && typeof maybeFunc.then === "function");
-        //@ts-ignore
-        if (method && (isFuncLike(method) || isObject(method) && isFuncLike(method.run))) {
-          //@ts-ignore
-          methods[key] = _methods[key];
+      getObjectEntries(_methods).map(([key, method]) => {
+        const isFuncLike = (maybeFunc: VoidFunction | Promise<void> | Promise<any>) =>
+          typeof maybeFunc === "function" || (maybeFunc && typeof maybeFunc.then === "function");
+        if (
+          method &&
+          (isFuncLike(method as Extract<Method, Promise<any>>) ||
+            // @ts-ignore
+            (isObject(method) && isFuncLike(method.run)))
+        ) {
+          methods[key] = _methods[key]!;
         } else {
-          throw `invalid publishMethods item -> ${key} \n Expecting a function or promise`
+          throw `invalid publishMethods item -> ${key} \n Expecting a function or promise`;
         }
       });
     }
@@ -62,16 +88,16 @@ export class PublishParser {
 
   /**
    * Parses the first level of publish. (If false then nothing if * then all tables and views)
-   * @param socket 
-   * @param user 
+   * @param socket
+   * @param user
    */
   async getPublish(localParams: LocalParams, clientInfo?: AuthResult): Promise<PublishObject> {
-    const publishParams = await this.getPublishParams(localParams, clientInfo)
+    const publishParams = await this.getPublishParams(localParams, clientInfo);
     const _publish = await applyParamsIfFunc(this.publish, publishParams);
 
     if (_publish === "*") {
       const publish: PublishObject = {};
-      this.prostgles.dboBuilder.tablesOrViews?.map(tov => {
+      this.prostgles.dboBuilder.tablesOrViews?.map((tov) => {
         publish[tov.name] = "*";
       });
       return publish;
@@ -79,29 +105,41 @@ export class PublishParser {
 
     return _publish;
   }
-  async getValidatedRequestRuleWusr({ tableName, command, localParams }: DboTableCommand): Promise<TableRule> {
-    
+  async getValidatedRequestRuleWusr({
+    tableName,
+    command,
+    localParams,
+  }: DboTableCommand): Promise<TableRule> {
     const clientInfo = await this.prostgles.authHandler!.getClientInfo(localParams);
-    const rules = await this.getValidatedRequestRule({ tableName, command, localParams }, clientInfo);
+    const rules = await this.getValidatedRequestRule(
+      { tableName, command, localParams },
+      clientInfo
+    );
     return rules;
   }
 
-  async getValidatedRequestRule({ tableName, command, localParams }: DboTableCommand, clientInfo?: AuthResult): Promise<TableRule> {
+  async getValidatedRequestRule(
+    { tableName, command, localParams }: DboTableCommand,
+    clientInfo?: AuthResult
+  ): Promise<TableRule> {
     if (!this.dbo) throw "INTERNAL ERROR: dbo is missing";
 
     if (!command || !tableName) throw "command OR tableName are missing";
 
-    const rtm = RULE_TO_METHODS.find(rtms => (rtms.methods as any).includes(command));
+    const rtm = RULE_TO_METHODS.find((rtms) => (rtms.methods as any).includes(command));
     if (!rtm) {
       throw "Invalid command: " + command;
     }
 
     /* Must be local request -> allow everything */
     if (!localParams || (!localParams.socket && !localParams.httpReq)) {
-      return RULE_TO_METHODS.reduce((a, v) => ({
-        ...a,
-        [v.rule]: v.no_limits
-      }), {})
+      return RULE_TO_METHODS.reduce(
+        (a, v) => ({
+          ...a,
+          [v.rule]: v.no_limits,
+        }),
+        {}
+      );
     }
 
     /* Must be from socket. Must have a publish */
@@ -113,44 +151,64 @@ export class PublishParser {
     if (errorInfo) throw errorInfo.error;
 
     const table_rule = await this.getTableRules({ tableName, localParams }, clientInfo);
-    if (!table_rule) throw { stack: ["getValidatedRequestRule()"], message: "Invalid or disallowed table: " + tableName };
-
+    if (!table_rule)
+      throw {
+        stack: ["getValidatedRequestRule()"],
+        message: "Invalid or disallowed table: " + tableName,
+      };
 
     if (command === "upsert") {
       if (!table_rule.update || !table_rule.insert) {
-        throw { stack: ["getValidatedRequestRule()"], message: `Invalid or disallowed command: upsert` };
+        throw {
+          stack: ["getValidatedRequestRule()"],
+          message: `Invalid or disallowed command: upsert`,
+        };
       }
     }
 
     if (rtm && table_rule && table_rule[rtm.rule]) {
       return table_rule;
-    } else throw { stack: ["getValidatedRequestRule()"], message: `Invalid or disallowed command: ${tableName}.${command}` };
+    } else
+      throw {
+        stack: ["getValidatedRequestRule()"],
+        message: `Invalid or disallowed command: ${tableName}.${command}`,
+      };
   }
 
-  async getTableRules(args: DboTable, clientInfo?: AuthResult): Promise<ParsedPublishTable | undefined> {
-
-    if(this.dbo[args.tableName]?.is_media){
-      const fileTablePublishRules = await this.getTableRulesWithoutFileTable(args, clientInfo)
-      const { rules } = await getFileTableRules.bind(this)(args.tableName, fileTablePublishRules, args.localParams, clientInfo);
+  async getTableRules(
+    args: DboTable,
+    clientInfo?: AuthResult
+  ): Promise<ParsedPublishTable | undefined> {
+    if (this.dbo[args.tableName]?.is_media) {
+      const fileTablePublishRules = await this.getTableRulesWithoutFileTable(args, clientInfo);
+      const { rules } = await getFileTableRules.bind(this)(
+        args.tableName,
+        fileTablePublishRules,
+        args.localParams,
+        clientInfo
+      );
       return rules;
     }
 
-    return await this.getTableRulesWithoutFileTable(args, clientInfo)
+    return await this.getTableRulesWithoutFileTable(args, clientInfo);
   }
 
   getTableRulesWithoutFileTable = getTableRulesWithoutFileTable.bind(this);
 
   /* Prepares schema for client. Only allowed views and commands will be present */
   getSchemaFromPublish = getSchemaFromPublish.bind(this);
-
 }
 
 export * from "./publishTypesAndUtils";
 
-type FunctionWithArguments = (...args: any) => any
-function applyParamsIfFunc<T>(maybeFunc: T, ...params: any): T extends FunctionWithArguments ? ReturnType<T> : T {
+type FunctionWithArguments = (...args: any) => any;
+function applyParamsIfFunc<T>(
+  maybeFunc: T,
+  ...params: any
+): T extends FunctionWithArguments ? ReturnType<T> : T {
   if (
-    (maybeFunc !== null && maybeFunc !== undefined) &&
+    maybeFunc !== null &&
+    maybeFunc !== undefined &&
     //@ts-ignore
     (typeof maybeFunc === "function" || typeof maybeFunc.then === "function")
   ) {

package/lib/PublishParser/getFileTableRules.ts

@@ -7,72 +7,102 @@ import { ParsedPublishTable, UpdateRule } from "./publishTypesAndUtils";
 
 /**
  * Permissions for referencedTables columns are propagated to the file table (even if file table has no permissions)
- * File table existing permissions that include the referenced column resulting permissions are left as they are 
+ * File table existing permissions that include the referenced column resulting permissions are left as they are
  * Select on a referenced column allows selecting from file table any records that join the referenced table and the select filters
- * Insert on a referenced column allows inserting a file (according to any file type/size rules) only if it is a nested from that table 
- * Update on a referenced column allows updating a file (delete and insert) only if it is a nested update from that table 
- * Delete on a referenced column table allows deleting any referenced file 
- */ 
-export async function getFileTableRules (this: PublishParser, fileTableName: string, fileTablePublishRules: ParsedPublishTable | undefined, localParams: LocalParams, clientInfo: AuthResult | undefined) {
+ * Insert on a referenced column allows inserting a file (according to any file type/size rules) only if it is a nested from that table
+ * Update on a referenced column allows updating a file (delete and insert) only if it is a nested update from that table
+ * Delete on a referenced column table allows deleting any referenced file
+ */
+export async function getFileTableRules(
+  this: PublishParser,
+  fileTableName: string,
+  fileTablePublishRules: ParsedPublishTable | undefined,
+  localParams: LocalParams,
+  clientInfo: AuthResult | undefined,
+) {
   const forcedDeleteFilters: FullFilter<AnyObject, void>[] = [];
   const forcedSelectFilters: FullFilter<AnyObject, void>[] = [];
-  const forcedUpdateFilters: FullFilter<AnyObject, void>[] = []; 
+  const forcedUpdateFilters: FullFilter<AnyObject, void>[] = [];
   const allowedNestedInserts: { table: string; column: string }[] = [];
-  const referencedColumns = this.prostgles.dboBuilder.tablesOrViews?.filter(t => !t.is_view && t.name !== fileTableName).map(t => {
-    const refCols = t.columns.filter(c => c.references?.some(r => r.ftable === fileTableName));
-    if(!refCols.length) return undefined;
-    return {
-      tableName: t.name,
-      fileColumns: refCols.map(c => c.name),
-      allColumns: t.columns.map(c => c.name),
-    }
-  }).filter(isDefined)
-  if(referencedColumns?.length){
-    for await (const { tableName, fileColumns, allColumns } of referencedColumns){
-      const table_rules = await this.getTableRules({ localParams, tableName }, clientInfo);
-      if(table_rules){
-        fileColumns.map(column => {
+  const referencedColumns = this.prostgles.dboBuilder.tablesOrViews
+    ?.filter((t) => !t.is_view && t.name !== fileTableName)
+    .map((t) => {
+      const refCols = t.columns.filter((c) =>
+        c.references?.some((r) => r.ftable === fileTableName),
+      );
+      if (!refCols.length) return undefined;
+      return {
+        tableName: t.name,
+        fileColumns: refCols.map((c) => c.name),
+        allColumns: t.columns.map((c) => c.name),
+      };
+    })
+    .filter(isDefined);
+  if (referencedColumns?.length) {
+    for await (const {
+      tableName,
+      fileColumns,
+      allColumns,
+    } of referencedColumns) {
+      const table_rules = await this.getTableRules(
+        { localParams, tableName },
+        clientInfo,
+      );
+      if (table_rules) {
+        fileColumns.map((column) => {
           const path = [{ table: tableName, on: [{ id: column }] }];
-          if(table_rules.delete){
+          if (table_rules.delete) {
             forcedDeleteFilters.push({
               $existsJoined: {
                 path,
                 filter: table_rules.delete.forcedFilter ?? {},
-              }
-            })
+              },
+            });
           }
-          if(table_rules.select){
-            const parsedFields = parseFieldFilter(table_rules.select.fields, false, allColumns);
+          if (table_rules.select) {
+            const parsedFields = parseFieldFilter(
+              table_rules.select.fields,
+              false,
+              allColumns,
+            );
             /** Must be allowed to view this column */
-            if(parsedFields.includes(column as any)){
+            if (parsedFields.includes(column as any)) {
               forcedSelectFilters.push({
                 $existsJoined: {
                   path,
                   filter: table_rules.select.forcedFilter ?? {},
-                }
+                },
               });
             }
           }
-          if(table_rules.insert){
-            const parsedFields = parseFieldFilter(table_rules.insert.fields, false, allColumns);
+          if (table_rules.insert) {
+            const parsedFields = parseFieldFilter(
+              table_rules.insert.fields,
+              false,
+              allColumns,
+            );
             /** Must be allowed to view this column */
-            if(parsedFields.includes(column as any)){
+            if (parsedFields.includes(column as any)) {
               allowedNestedInserts.push({ table: tableName, column });
             }
           }
-          if(table_rules.update){
-            const parsedFields = parseFieldFilter(table_rules.update.fields, false, allColumns);
+          if (table_rules.update) {
+            const parsedFields = parseFieldFilter(
+              table_rules.update.fields,
+              false,
+              allColumns,
+            );
             /** Must be allowed to view this column */
-            if(parsedFields.includes(column as any)){
+            if (parsedFields.includes(column as any)) {
               forcedUpdateFilters.push({
                 $existsJoined: {
                   path,
                   filter: table_rules.update.forcedFilter ?? {},
-                }
+                },
               });
             }
           }
-        })
+        });
       }
     }
   }
@@ -81,44 +111,57 @@ export async function getFileTableRules (this: PublishParser, fileTableName: str
     ...fileTablePublishRules,
   };
 
-  const getForcedFilter = (rule: Pick<UpdateRule, "forcedFilter"> | undefined, forcedFilters: FullFilter<AnyObject, void>[]) => {
-    return (rule && !rule.forcedFilter)?  {} : {
-      forcedFilter: {
-        $or: forcedFilters.concat(rule?.forcedFilter? [rule?.forcedFilter] : []),
-      }
-    }
-  }
-  if(forcedSelectFilters.length || fileTablePublishRules?.select){
+  const getForcedFilter = (
+    rule: Pick<UpdateRule, "forcedFilter"> | undefined,
+    forcedFilters: FullFilter<AnyObject, void>[],
+  ) => {
+    return rule && !rule.forcedFilter
+      ? {}
+      : {
+          forcedFilter: {
+            $or: forcedFilters.concat(
+              rule?.forcedFilter ? [rule?.forcedFilter] : [],
+            ),
+          },
+        };
+  };
+  if (forcedSelectFilters.length || fileTablePublishRules?.select) {
     fileTableRule.select = {
       fields: "*",
       ...fileTablePublishRules?.select,
       ...getForcedFilter(fileTablePublishRules?.select, forcedSelectFilters),
-    }
+    };
   }
-  if(forcedDeleteFilters.length || fileTablePublishRules?.delete){
+  if (forcedDeleteFilters.length || fileTablePublishRules?.delete) {
     fileTableRule.delete = {
       filterFields: "*",
       ...fileTablePublishRules?.delete,
       ...getForcedFilter(fileTablePublishRules?.delete, forcedDeleteFilters),
-    }
+    };
   }
-  if(forcedUpdateFilters.length || fileTablePublishRules?.update){
+  if (forcedUpdateFilters.length || fileTablePublishRules?.update) {
     fileTableRule.update = {
       fields: "*",
       ...fileTablePublishRules?.update,
       ...getForcedFilter(fileTablePublishRules?.update, forcedUpdateFilters),
-    }
+    };
   }
 
-  if(allowedNestedInserts.length || fileTablePublishRules?.insert){
+  if (allowedNestedInserts.length || fileTablePublishRules?.insert) {
     fileTableRule.insert = {
       fields: "*",
       ...fileTablePublishRules?.insert,
-      allowedNestedInserts: fileTablePublishRules?.insert? undefined : allowedNestedInserts,
-    }
+      allowedNestedInserts: fileTablePublishRules?.insert
+        ? undefined
+        : allowedNestedInserts,
+    };
   }
 
   /** Add missing implied methods (getColumns, getInfo) */
-  const rules = await this.getTableRulesWithoutFileTable.bind(this)({ localParams, tableName: fileTableName }, clientInfo, { [fileTableName]: fileTableRule })
+  const rules = await this.getTableRulesWithoutFileTable.bind(this)(
+    { localParams, tableName: fileTableName },
+    clientInfo,
+    { [fileTableName]: fileTableRule },
+  );
   return { rules, allowedInserts: allowedNestedInserts };
-}
+}