prostgles-server 4.2.448 → 4.2.450

package/lib/Filtering.ts

@@ -1,6 +1,4 @@
-import type {
-  FilterDataType,
-  FullFilter} from "prostgles-types";
+import type { FilterDataType, FullFilter } from "prostgles-types";
 import {
   BetweenFilterKeys,
   CompareFilterKeys,
@@ -47,7 +45,7 @@ export const FILTER_OPERAND_TO_SQL_OPERAND = Object.fromEntries(
     else if (filterOperand === "$isDistinctFrom") sqlOperand = "IS DISTINCT FROM";
     else if (filterOperand === "$isNotDistinctFrom") sqlOperand = "IS NOT DISTINCT FROM";
     return [filterOperand, sqlOperand];
-  })
+  }),
 ) as Record<(typeof FILTER_OPERANDS)[number], string>;
 
 /**
@@ -57,12 +55,12 @@ export const FILTER_OPERAND_TO_SQL_OPERAND = Object.fromEntries(
 type ParseFilterItemArgs = {
   filter: FullFilter<void, void> | undefined;
   select: SelectItemValidated[] | undefined;
-  tableAlias: string | undefined;
+  tableAliasRaw: string | undefined;
   allowedColumnNames: string[];
 };
 
 export const parseFilterItem = (args: ParseFilterItemArgs): string => {
-  const { filter: _f, select, tableAlias, allowedColumnNames } = args;
+  const { filter: _f, select, tableAliasRaw, allowedColumnNames } = args;
 
   if (!_f || isEmpty(_f)) return "";
 
@@ -84,9 +82,9 @@ export const parseFilterItem = (args: ParseFilterItemArgs): string => {
         parseFilterItem({
           filter: { [fk]: _f[fk] },
           select,
-          tableAlias,
+          tableAliasRaw,
           allowedColumnNames,
-        })
+        }),
       )
       .sort() /*  sorted to ensure duplicate subscription channels are not created due to different condition order */
       .join(" AND ");
@@ -106,7 +104,7 @@ export const parseFilterItem = (args: ParseFilterItemArgs): string => {
       const dissallowedFields = fields.filter((fname) => !allowedColumnNames.includes(fname));
       if (dissallowedFields.length) {
         throw new Error(
-          `Invalid/disallowed columns found in filter: ${dissallowedFields.join(", ")}`
+          `Invalid/disallowed columns found in filter: ${dissallowedFields.join(", ")}`,
         );
       }
     }
@@ -114,7 +112,7 @@ export const parseFilterItem = (args: ParseFilterItemArgs): string => {
   const getLeftQ = (selItm: SelectItemValidated) => {
     validateSelectedItemFilter(selItem);
     if (selItm.type === "function" || selItm.type === "aggregation") return selItm.getQuery();
-    return selItm.getQuery(tableAlias);
+    return selItm.getQuery(tableAliasRaw);
   };
 
   /**
@@ -131,14 +129,14 @@ export const parseFilterItem = (args: ParseFilterItemArgs): string => {
     /* See if dot notation. Pick the best matching starting string */
     if (select) {
       selItem = select.find((s) =>
-        dot_notation_delims.find((delimiter) => fKey.startsWith(s.alias + delimiter))
+        dot_notation_delims.find((delimiter) => fKey.startsWith(s.alias + delimiter)),
       );
       validateSelectedItemFilter(selItem);
     }
     if (!selItem) {
       return mErr(
         "Bad filter. Could not match to a column or alias or dot notation" +
-          select?.map((s) => s.alias).join(", ")
+          select?.map((s) => s.alias).join(", "),
       );
     }
 
@@ -148,7 +146,7 @@ export const parseFilterItem = (args: ParseFilterItemArgs): string => {
     if (remainingStr.startsWith("->")) {
       /** Has shorthand operand 'col->>key.<>'  */
       const matchingOperand = CompareFilterKeys.find((operand) =>
-        remainingStr.endsWith(`.${operand}`)
+        remainingStr.endsWith(`.${operand}`),
       );
       if (matchingOperand) {
         remainingStr = remainingStr.slice(0, -matchingOperand.length - 1);

package/lib/PublishParser/PublishParser.ts

@@ -1,4 +1,4 @@
-import { getKeys, includes, pickKeys } from "prostgles-types";
+import { getObjectEntries, includes, isDefined, pickKeys } from "prostgles-types";
 import { getClientRequestIPsInfo } from "../Auth/AuthHandler";
 import type { AuthClientRequest, AuthResultWithSID } from "../Auth/AuthTypes";
 import type { DBOFullyTyped } from "../DBSchemaBuilder/DBSchemaBuilder";
@@ -212,10 +212,61 @@ export class PublishParser {
       }
       const tableScope = scope.tables?.[args.tableName];
       if (!tableScope) return;
-      return pickKeys(
-        tableRules,
-        getKeys(tableScope).filter((k) => tableScope[k]),
-      );
+
+      const tableHandler = this.dbo[args.tableName];
+      if (!tableHandler) {
+        throw "INTERNAL ERROR: table handler not found for " + args.tableName;
+      }
+      const validatedTableRules = tableHandler.getValidatedRules?.(tableRules);
+      if (!validatedTableRules) {
+        throw "INTERNAL ERROR: getValidatedRules is missing for " + args.tableName;
+      }
+
+      /** Make sure the scope does not allow things outside the validatedTableRules */
+      const result = fromEntries(
+        getObjectEntries(tableScope)
+          .map(([ruleName, ruleScope]) => {
+            if (!ruleScope) return undefined;
+            const rule = tableRules[ruleName];
+            const validatedRule = validatedTableRules[ruleName];
+            if (!validatedRule || !rule) {
+              throw `Invalid scope: ${args.tableName}.${ruleName}. The publish does not allow this command.`;
+            }
+            if (ruleScope === true) {
+              return [ruleName, validatedRule] as const;
+            }
+            const scopeFields = tableHandler.parseFieldFilter!(ruleScope.fields);
+            const scopeForcedFilter =
+              "forcedFilter" in ruleScope ? ruleScope.forcedFilter : undefined;
+
+            const ruleFields = "fields" in validatedRule ? validatedRule.fields : undefined;
+            for (const field of scopeFields) {
+              if (!ruleFields?.includes(field)) {
+                throw `Invalid scope: ${args.tableName}.${ruleName}. The field "${field}" is not allowed to be selected according to the publish rules.`;
+              }
+            }
+            if (!scopeFields.length) {
+              throw `Invalid scope: ${args.tableName}.${ruleName}. At least one field must be selected.`;
+            }
+            const ruleForcedFilter =
+              "forcedFilter" in validatedRule ? validatedRule.forcedFilter : undefined;
+            const combinedForcedFilter =
+              scopeForcedFilter && ruleForcedFilter ?
+                { $and: [scopeForcedFilter, ruleForcedFilter] }
+              : scopeForcedFilter || ruleForcedFilter;
+
+            return [
+              ruleName,
+              {
+                ...rule,
+                fields: fromEntries(scopeFields.map((field) => [field, 1] as const)),
+                ...(scopeForcedFilter ? { forcedFilter: combinedForcedFilter } : {}),
+              } as any,
+            ] as const;
+          })
+          .filter(isDefined),
+      ) as ParsedTableRule;
+      return result;
     };
     if (this.dbo[args.tableName]?.is_media) {
       const { rules: fileTableRules } = await getFileTableRules.bind(this)(
@@ -256,3 +307,9 @@ function applyParamsIfFunc<T>(
   //@ts-ignore
   return maybeFunc;
 }
+
+export const fromEntries = <K extends string | number | symbol, V>(
+  entries: readonly (readonly [K, V])[],
+): Record<K, V> => {
+  return Object.fromEntries(entries) as Record<K, V>;
+};

package/lib/PublishParser/getSchemaFromPublish.ts

@@ -144,7 +144,7 @@ export async function getSchemaFromPublish(
 
                       throw {
                         ...getErrorAsObject(e),
-                        publish_path: `publish.${tableName}.${method}: \n   -> ${e}`,
+                        publish_path: `publish.${tableName}.${method}`,
                       };
                     }
                   }

package/lib/PublishParser/getTableRulesWithoutFileTable.ts

@@ -1,4 +1,4 @@
-import { getKeys, isObject } from "prostgles-types";
+import { getKeys, includes, isObject } from "prostgles-types";
 import type { AuthResultWithSID } from "../Auth/AuthTypes";
 import type { TableHandler } from "../DboBuilder/TableHandler/TableHandler";
 import type { ViewHandler } from "../DboBuilder/ViewHandler/ViewHandler";
@@ -73,7 +73,7 @@ export async function getTableRulesWithoutFileTable(
   });
 
   /* All methods allowed. Add no limits for table rules */
-  if ([true, "*"].includes(rawTableRule as any)) {
+  if (includes([true, "*"], rawTableRule)) {
     parsedTableRule = {};
     MY_RULES.filter((r) => r.no_limits).forEach((r) => {
       parsedTableRule[r.rule] = { ...(r.no_limits as object) } as any;

package/lib/PublishParser/publishTypesAndUtils.ts

@@ -506,7 +506,29 @@ export type DbTableInfo = {
 export type PermissionScope = {
   sql?: "commited" | "rolledback";
   /** TODO: this should match publish types */
-  tables?: Record<string, Partial<Record<"select" | "update" | "delete" | "insert", boolean>>>;
+  tables?: Record<
+    string,
+    Partial<{
+      select:
+        | true
+        | {
+            fields: FieldFilter;
+            forcedFilter: AnyObject;
+          };
+      insert:
+        | true
+        | {
+            fields: FieldFilter;
+          };
+      update:
+        | true
+        | {
+            fields: FieldFilter;
+            forcedFilter: AnyObject;
+          };
+      delete: true;
+    }>
+  >;
   methods?: Record<string, boolean>;
 };
 export type PublishParams<S = void, SUser extends SessionUser = SessionUser> = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prostgles-server",
-  "version": "4.2.448",
+  "version": "4.2.450",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -38,16 +38,16 @@
   ],
   "homepage": "https://prostgles.com",
   "dependencies": {
-    "@aws-sdk/client-ses": "^3.985.0",
-    "@aws-sdk/credential-provider-node": "^3.972.4",
+    "@aws-sdk/client-ses": "^3.993.0",
+    "@aws-sdk/credential-provider-node": "^3.972.10",
     "@types/passport": "^1.0.17",
-    "@types/passport-facebook": "^3.0.3",
+    "@types/passport-facebook": "^3.0.4",
     "@types/passport-github2": "^1.2.9",
-    "@types/passport-google-oauth20": "^2.0.16",
+    "@types/passport-google-oauth20": "^2.0.17",
     "@types/passport-microsoft": "^1.0.3",
     "check-disk-space": "^3.4.0",
-    "file-type": "^18.5.0",
-    "nodemailer": "^7.0.12",
+    "file-type": "^18.7.0",
+    "nodemailer": "^7.0.13",
     "passport": "^0.7.0",
     "passport-facebook": "^3.0.0",
     "passport-github2": "^0.1.12",
@@ -56,23 +56,23 @@
     "passport-oauth2": "^1.8.0",
     "pg": "^8.15.6",
     "pg-cursor": "^2.17.0",
-    "pg-promise": "^12.6.0",
-    "prostgles-types": "^4.0.209"
+    "pg-promise": "^12.6.1",
+    "prostgles-types": "^4.0.211"
   },
   "devDependencies": {
     "@eslint/js": "^9.22.0",
-    "@types/express": "^4.17.21",
+    "@types/express": "^4.17.25",
     "@types/json-schema": "^7.0.15",
-    "@types/node": "^22.10.2",
-    "@types/nodemailer": "^6.4.17",
-    "@types/pg": "^8.15.1",
+    "@types/node": "^22.19.11",
+    "@types/nodemailer": "^6.4.22",
+    "@types/pg": "^8.16.0",
     "@types/pg-cursor": "^2.7.2",
-    "@types/sharp": "^0.30.4",
+    "@types/sharp": "^0.30.5",
     "eslint": "^9.39.2",
     "eslint-plugin-security": "^3.0.1",
-    "prettier": "^3.4.2",
-    "socket.io": "^4.8.1",
-    "typescript": "^5.3.3",
-    "typescript-eslint": "^8.38.0"
+    "prettier": "^3.8.1",
+    "socket.io": "^4.8.3",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.56.0"
   }
 }