w-serv-orm 1.1.7 → 1.1.9

package/src/getProc.mjs

@@ -1,180 +1,104 @@
-import get from 'lodash-es/get.js'
-import size from 'lodash-es/size.js'
-import filter from 'lodash-es/filter.js'
-import isarr from 'wsemi/src/isarr.mjs'
-import isestr from 'wsemi/src/isestr.mjs'
-import haskey from 'wsemi/src/haskey.mjs'
-import pmSeries from 'wsemi/src/pmSeries.mjs'
-import pmChain from 'wsemi/src/pmChain.mjs'
-import isfun from 'wsemi/src/isfun.mjs'
-import isbol from 'wsemi/src/isbol.mjs'
-
-
-let _funChecks = []
-let _funPreProcessing = []
-let _funPostProcessing = []
-let _mapOrm = null
-let _getUserById = null
-let useCheckUser = true
-let useExcludeWhenNotAdmin = true
-
-
-function addFunCheck(f) {
-    //由外部添加擴充檢查函數
-
-    setTimeout(() => { //因互相引用的關係會出現「Cannot access '_funChecks' before initialization」, 故通過timer脫勾成為動態引用, 避開執行mInitialTestData時會先編譯與偵測問題
-        _funChecks.push(f)
-    }, 1)
-
-}
-
-
-function addFunPreProcessing(f) {
-    //由外部添加擴充前處理函數
-
-    setTimeout(() => { //因互相引用的關係會出現「Cannot access '_funChecks' before initialization」, 故通過timer脫勾成為動態引用, 避開執行mInitialTestData時會先編譯與偵測問題
-        _funPreProcessing.push(f)
-    }, 1)
-
-}
-
-
-function addFunPostProcessing(f) {
-    //由外部添加擴充後置處理函數
-
-    setTimeout(() => { //因互相引用的關係會出現「Cannot access '_funChecks' before initialization」, 故通過timer脫勾成為動態引用, 避開執行mInitialTestData時會先編譯與偵測問題
-        _funPostProcessing.push(f)
-    }, 1)
-
-}
-
-
-async function procOrm(userId, woName, mode, input) {
-    //封裝mapOrm, 添加檢查userId功能
-
-    //check
-    if (!isfun(_mapOrm)) {
-        return Promise.reject(`invalid mapOrm`)
-    }
-
-    //check
-    if (useCheckUser && !isestr(userId)) {
-        console.log('userId', userId)
-        console.log('找不到使用者主鍵')
-        return Promise.reject(`找不到使用者主鍵`)
-    }
-
-    //isAdmin
-    let isAdmin = 'n'
-
-    //useCheckUser
-    if (useCheckUser) {
-
-        //check
-        if (!isfun(_getUserById)) {
-            return Promise.reject(`invalid getUserById`)
-        }
-
-        //oSelf
-        let oSelf = await _getUserById(userId)
-
-        //check
-        if (!oSelf) {
-            console.log('userId', userId)
-            console.log('找不到使用者資訊')
-            return Promise.reject(`找不到使用者資訊`)
-        }
-
-        //isAdmin
-        isAdmin = get(oSelf, 'isAdmin')
-        if (isAdmin !== 'y' && isAdmin !== 'n') {
-            isAdmin = 'n'
-        }
-
-        //isActive
-        let isActive = get(oSelf, 'isActive')
-        if (isActive !== 'y' && isActive !== 'n') {
-            isActive = 'n'
-        }
-
-        //check
-        if (isActive !== 'y') {
-            console.log('userId', userId)
-            console.log('oSelf', oSelf)
-            console.log('使用者被停權或無有效使用者資訊')
-            return Promise.reject(`使用者被停權或無有效使用者資訊`)
-        }
-
-    }
-
-    //_funChecks, 擴充檢查, 提供給各 mOrm[OOO].mjs 檢查
-    await pmSeries(_funChecks, (v) => {
-        return v({ woName, userId, isAdmin, mode, input })
-    })
-
-    //_funPreProcessing, 擴充前處理input, 提供給各 mOrm[OOO].mjs 前處理
-    if (size(_funPreProcessing) > 0) {
-        let paramsIn = { woName, userId, isAdmin, mode, input } //將input與其他資訊一起封裝成params
-        let paramsOut = await pmChain(_funPreProcessing, paramsIn) //各非同步函數拿到輸入處理完皆輸出一樣結構數據params, 使各非同步函數都可拿到非input的重要資訊
-        input = paramsOut.input //由params提取input出來
-    }
-
-    //output
-    let output = await _mapOrm(userId, woName, mode, input)
-
-    //useExcludeWhenNotAdmin, 非管理者則要過濾掉已刪除之數據
-    if (useExcludeWhenNotAdmin && isAdmin === 'n') {
-        if (mode === 'select' && isarr(output)) { //有可能為錯誤物件
-            output = filter(output, (v) => {
-                if (haskey(v, 'isActive')) { //針對有isActive屬性
-                    return !(v.isActive === 'n') //過濾isActive='n'
-                }
-                return true
-            })
-        }
-    }
-
-    //_funPostProcessing, 擴充後處理output, 提供給各 mOrm[OOO].mjs 後處理
-    if (size(_funPostProcessing) > 0) {
-        output = await pmChain(_funPostProcessing, { woName, userId, isAdmin, mode, input, output })
-    }
-
-    return output
-}
-
-
-function getProc(mapOrm, opt = {}) {
-
-    //check
-    if (!isfun(mapOrm)) {
-        return Promise.reject(`invalid mapOrm`)
-    }
-
-    //save _mapOrm
-    _mapOrm = mapOrm
-
-    //useCheckUser
-    useCheckUser = get(opt, 'useCheckUser')
-    if (!isbol(useCheckUser)) {
-        useCheckUser = true
-    }
-
-    //save _getUserById, 不事先檢查, 因若useCheckUser=false可允許不給
-    _getUserById = get(opt, 'getUserById')
-
-    //useExcludeWhenNotAdmin
-    useExcludeWhenNotAdmin = get(opt, 'useExcludeWhenNotAdmin')
-    if (!isbol(useExcludeWhenNotAdmin)) {
-        useExcludeWhenNotAdmin = true
-    }
-
-    return {
-        addFunCheck,
-        addFunPreProcessing,
-        addFunPostProcessing,
-        procOrm,
-    }
-}
-
-
-export default getProc
+import iseobj from 'wsemi/src/iseobj.mjs'
+import pmSeries from 'wsemi/src/pmSeries.mjs'
+import isfun from 'wsemi/src/isfun.mjs'
+
+
+function addFun(fs, f, name, useGuard = false) {
+    //由外部添加擴充函數至該實例之陣列
+    //延後1ms生效係沿用既有之生效時序: 原為避開模組層陣列於循環引用時之「Cannot access before initialization」,
+    //改為各實例狀態後該原因已不成立, 惟使用端之啟動流程可能依賴此時序, 故保留
+
+    //check, 非函數於註冊時即拋錯; useGuard(check用)另推入恆reject之守門函數, 令拋錯被呼叫端攔下時該實例仍維持fail-closed
+    //註冊時拋錯屬建構期錯誤故為Error; 守門函數於procOrm內reject, 與procOrm其餘拒絕一致為字串
+    if (!isfun(f)) {
+        let msg = `${name} needs a function, but got ${typeof f}`
+        if (useGuard) {
+            fs.push(() => {
+                return Promise.reject(msg)
+            })
+        }
+        throw new Error(msg)
+    }
+
+    setTimeout(() => {
+        fs.push(f)
+    }, 1)
+
+}
+
+
+async function procOrm(st, userId, woName, mode, input) {
+    //封裝mapOrm, 依序執行擴充檢查、前處理、ORM操作與後處理, st為該實例之狀態
+    //不做授權: 不檢查使用者亦不依使用者過濾數據, userId只供寫入稽核欄位與交給擴充函數; 開放給前端時須由開放處負責授權
+
+    //check
+    if (!isfun(st.mapOrm)) {
+        return Promise.reject(`invalid mapOrm`)
+    }
+
+    //funChecks, 擴充檢查, 提供給各 mOrm[OOO].mjs 檢查
+    await pmSeries(st.funChecks, (v) => {
+        return v({ woName, userId, mode, input })
+    })
+
+    //funPreProcessing, 擴充前處理input, 提供給各 mOrm[OOO].mjs 前處理
+    //逐一呼叫, 各前處理皆收新建之參數物件, input為前一個回傳之input; 回傳須為含input之物件, 否則reject, 避免input成為undefined而令select回全表
+    //迭代前先取快照, 呼叫進行中註冊者不套用於本次呼叫
+    for (let f of [...st.funPreProcessing]) {
+        let paramsOut = await f({ woName, userId, mode, input })
+        if (!iseobj(paramsOut) || paramsOut.input === undefined) {
+            return Promise.reject(`invalid return of pre-processing, need an object with input`)
+        }
+        input = paramsOut.input
+    }
+
+    //output
+    let output = await st.mapOrm(userId, woName, mode, input)
+
+    //funPostProcessing, 擴充後處理output, 提供給各 mOrm[OOO].mjs 後處理
+    //逐一呼叫, 各後處理皆收新建之參數物件, output為前一個之回傳值, 回傳值成為新output; 迭代前先取快照
+    for (let f of [...st.funPostProcessing]) {
+        output = await f({ woName, userId, mode, input, output })
+    }
+
+    return output
+}
+
+
+function getProc(mapOrm) {
+
+    //check
+    if (!isfun(mapOrm)) {
+        return Promise.reject(`invalid mapOrm`)
+    }
+
+    //st, 各實例之狀態, 每次呼叫各自建立, 令同一行程內之多個實例互不干擾
+    let st = {
+        funChecks: [],
+        funPreProcessing: [],
+        funPostProcessing: [],
+        mapOrm,
+    }
+
+    //回傳函數綁定st而不依賴this, 使用端可解構取用並當裸函數傳遞
+    return {
+        addFunCheck: (f) => {
+            //由外部添加擴充檢查函數
+            addFun(st.funChecks, f, 'addFunCheck', true)
+        },
+        addFunPreProcessing: (f) => {
+            //由外部添加擴充前處理函數
+            addFun(st.funPreProcessing, f, 'addFunPreProcessing')
+        },
+        addFunPostProcessing: (f) => {
+            //由外部添加擴充後置處理函數
+            addFun(st.funPostProcessing, f, 'addFunPostProcessing')
+        },
+        procOrm: async (userId, woName, mode, input) => {
+            return procOrm(st, userId, woName, mode, input)
+        },
+    }
+}
+
+
+export default getProc

package/src/getSettings.mjs

@@ -76,7 +76,7 @@ function getSettings(opt = {}) {
     }
     catch (err) {
         console.log(err)
-        throw new Error('伺服器讀取設定檔失敗')
+        throw new Error('failed to read settings file')
     }
 
     return st

package/test/api-procOrm.test.mjs

@@ -46,7 +46,7 @@ describe('procOrm接w-orm-lowdb', function() {
     it('A02 del含無效主鍵', async function() {
         //R02: 逐筆ok為0即reject並列出失敗主鍵; R10: 單筆失敗不中斷整批, 有效筆已刪除
         let err = await getReject(proc('del', [{ id: 'a1' }, { id: 123 }]))
-        assert.strict.equal(err, '刪除資料失敗: id[123]')
+        assert.strict.equal(err, 'failed to delete data: id[123]')
         let rs = await proc('select', { id: 'a1' })
         assert.strict.equal(rs.length, 0)
     })
@@ -54,7 +54,7 @@ describe('procOrm接w-orm-lowdb', function() {
     it('A03 mix之del含無效主鍵', async function() {
         //R03: del之逐筆失敗不中斷diff, diff已寫入, 最後reject列出del之失敗
         let err = await getReject(proc('mix', { del: [{ id: 456 }], diff: [{ id: 'a2', isActive: 'y' }] }))
-        assert.strict.equal(err, '刪除資料失敗: id[456]')
+        assert.strict.equal(err, 'failed to delete data: id[456]')
         let rs = await proc('select', { id: 'a2' })
         assert.strict.equal(rs.length, 1)
     })
@@ -65,4 +65,29 @@ describe('procOrm接w-orm-lowdb', function() {
         assert.strict.deepEqual(r, [{ n: 0, nDeleted: 0, ok: 1 }])
     })
 
+    it('A05 save未帶主鍵時回傳之id可於資料庫查得', async function() {
+        //D1: 本套件補值並回傳, 與實際寫入之主鍵一致
+        let r = await proc('save', [{ isActive: 'y' }])
+        assert.ok(typeof r[0].id === 'string' && r[0].id.length > 0)
+        let rs = await proc('select', { id: r[0].id })
+        assert.strict.equal(rs.length, 1)
+    })
+
+    it('A06 主鍵為數學式者可依原主鍵查詢與刪除', async function() {
+        //wsemi 1.9.13起數學式不被clearXSS改寫, 寫入之主鍵即呼叫端所持者(1.9.12時會存成a < b而查不到、刪不掉)
+        let r = await proc('save', [{ id: 'a < b', isActive: 'y' }])
+        assert.strict.deepEqual(r, [{ id: 'a < b' }])
+        let rs = await proc('select', { id: 'a < b' })
+        assert.strict.equal(rs.length, 1)
+        let rd = await proc('del', [{ id: 'a < b' }])
+        assert.strict.deepEqual(rd, [{ n: 1, nDeleted: 1, ok: 1 }])
+    })
+
+    it('A07 主鍵會被改寫者整批拒絕且未寫入任何一筆', async function() {
+        let err = await getReject(proc('save', [{ id: 'ok-2', isActive: 'y' }, { id: 'a<b', isActive: 'y' }]))
+        assert.strict.equal(err, 'failed to save data, id contains HTML markup: data[1]')
+        let rs = await proc('select', {})
+        assert.ok(!rs.some((v) => ['ok-2', 'a<b', 'a&lt;b'].includes(v.id)), JSON.stringify(rs))
+    })
+
 })