zet-lib 3.3.0 → 3.3.2

package/lib/Form.js

@@ -512,11 +512,11 @@ Form.field = (obj) => {
       });
 
       displayForm += `<div id="dragdrop_${obj.id}" class="row contentfields">
-        <div class="col-md-6">
+        <div class="col-6">
             <h5>${obj.attributes.left}</h5>
             <ol class="mydragable${obj.id} divboxlittle" data-type="left" data-name="${obj.name}[]">${leftButtons}</ol>
         </div>
-        <div class="col-md-6">
+        <div class="col-6">
         <h5>${obj.attributes.right}</h5>
             <ol class="mydragable${obj.id} divboxlittle" data-type="right"  data-name="trashx">
                 ${rightButtons}

package/lib/connection.js

@@ -21,6 +21,77 @@ pool.on('error', (err) => {
   console.error('Unexpected error on idle client', err)
 })
 
+// Validasi identifier (nama tabel) untuk mencegah SQL injection
+const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*(?:\.[a-zA-Z_][a-zA-Z0-9_]*)?$/
+const sanitizeTableName = (table) => {
+  if (typeof table !== 'string' || !table.trim()) return ''
+  const t = table.trim()
+  if (!SAFE_IDENTIFIER.test(t)) {
+    throw new Error(`Invalid table name: ${t}`)
+  }
+  return t
+}
+
+// Validasi limit/offset sebagai integer non-negatif
+const toSafeNonNegativeInt = (val, fallback) => {
+  if (val === undefined || val === null) return fallback
+  const n = parseInt(val, 10)
+  if (!Number.isInteger(n) || n < 0) return fallback
+  return n
+}
+
+// Validasi satu segmen ORDER BY (identifier + optional ASC/DESC) untuk mencegah SQL injection
+const SAFE_IDENTIFIER_PART = /^[a-zA-Z_][a-zA-Z0-9_]*$/
+const sanitizeOrderBySegment = (segment) => {
+  if (typeof segment !== 'string' || !segment.trim()) return ''
+  const parts = segment.trim().split(/\s+/)
+  const ident = parts[0]
+  const dir = parts[1] ? parts[1].toUpperCase() : ''
+  if (dir && dir !== 'ASC' && dir !== 'DESC') return ''
+  const identParts = ident.split('.')
+  const valid = identParts.length > 0 && identParts.every(p => SAFE_IDENTIFIER_PART.test(p))
+  if (!valid) return ''
+  const quotedIdent = identParts.map(p => `"${p}"`).join('.')
+  return dir ? `${quotedIdent} ${dir}` : quotedIdent
+}
+
+// Validasi nama kolom (identifier tunggal) untuk INSERT/UPDATE
+const sanitizeColumnName = (key) => SAFE_IDENTIFIER_PART.test(String(key).trim()) ? String(key).trim() : null
+
+// Validasi klausa RETURNING: hanya RETURNING * atau RETURNING col1, col2, ...
+const SAFE_RETURNING = /^RETURNING \*$/i
+const SAFE_RETURNING_COLS = /^RETURNING ([a-zA-Z_][a-zA-Z0-9_]*)(,\s*[a-zA-Z_][a-zA-Z0-9_]*)*$/i
+const sanitizeReturning = (clause) => {
+  if (typeof clause !== 'string' || !clause.trim()) return 'RETURNING *'
+  const s = clause.trim()
+  if (SAFE_RETURNING.test(s)) return s
+  if (SAFE_RETURNING_COLS.test(s)) return s
+  return 'RETURNING *'
+}
+
+// Validasi field di WHERE (identifier atau schema.table)
+const sanitizeWhereField = (field) => {
+  if (field == null || typeof field !== 'string' || !field.trim()) return ''
+  const identParts = String(field).trim().split('.')
+  const valid = identParts.length > 0 && identParts.every(p => SAFE_IDENTIFIER_PART.test(p))
+  if (!valid) return ''
+  return identParts.map(p => `"${p}"`).join('.')
+}
+
+// Whitelist operator perbandingan untuk WHERE
+const SAFE_WHERE_OPERATORS = new Set(['=', '!=', '<>', '<', '>', '<=', '>=', 'LIKE', 'ILIKE', 'IS NOT', 'IS'])
+const sanitizeWhereOption = (option) => {
+  if (option == null || typeof option !== 'string') return ''
+  const s = String(option).trim().toUpperCase()
+  return SAFE_WHERE_OPERATORS.has(s) ? s : ''
+}
+
+const sanitizeWhereConnector = (op) => {
+  if (op == null || typeof op !== 'string') return ' AND '
+  const s = String(op).trim().toUpperCase()
+  return (s === 'OR' ? ' OR ' : ' AND ')
+}
+
 const connection = {}
 
 connection.query = async (string, arr) => {
@@ -53,9 +124,11 @@ const orderByFn = (obj) => {
       }
     }
   }
-  if (obj.hasOwnProperty('order_by')) {
-    orderBy = ` ORDER BY  `
-    orderBy += obj.order_by.join(',')
+  if (obj.hasOwnProperty('order_by') && Array.isArray(obj.order_by) && obj.order_by.length) {
+    const segments = obj.order_by.map(sanitizeOrderBySegment).filter(Boolean)
+    if (segments.length) {
+      orderBy = ` ORDER BY ${segments.join(', ')} `
+    }
   }
 
   return orderBy
@@ -67,7 +140,7 @@ const whereFn = (obj) => {
   const whereArray = obj.whereArray || []
   let increment = 1
   let arr = [],
-    wherequery = []
+      wherequery = []
   for (const key in where) {
     wherequery.push(key.indexOf('.') > -1 ? ` ${key} = $${increment} ` : ` "${key}" = $${increment}`)
     arr.push(where[key])
@@ -93,14 +166,17 @@ const whereFn = (obj) => {
       } else {
         field = item.field.indexOf('.') > -1 ? item.field : item.field ? ` "${item.field}" ` : ''
       }
-      //is JSON is field is JSON
-      //JSON_CONTAINS(color, '"Red"' ,'$')
+      // PostgreSQL: jsonb containment (@>) dengan parameter untuk keamanan
       if (item.isJSON) {
-        wherequery += andOr + ` JSON_CONTAINS(${field}, '"${item.value}"' ,'$')  ${operator}`
+        wherequery += andOr + ` (${String(field).trim()})::jsonb @> $${increment}::jsonb ${operator}`
+        arr.push(JSON.stringify(item.value))
+        increment++
         hasWhere = true
       } else {
         if (type == 'json') {
-          wherequery += andOr + ` JSON_CONTAINS(${field}, '"${item.value}"' ,'$')  ${operator}`
+          wherequery += andOr + ` (${String(field).trim()})::jsonb @> $${increment}::jsonb ${operator}`
+          arr.push(JSON.stringify(item.value))
+          increment++
           hasWhere = true
         } else if (type == 'inline') {
           //select * from attendance where employee_id = 4803 and date IN ('2023-12-21','2023-12-22')
@@ -150,11 +226,13 @@ const whereFn = (obj) => {
 }
 
 connection.results = async (obj) => {
+  const table = sanitizeTableName(obj.table || '')
   const select = obj.select || '*'
-  const table = obj.table || ''
   const statement = obj.statement || ''
-  const limit = obj.limit ? ` LIMIT ${obj.limit} ` : ''
-  const offset = obj.hasOwnProperty('offset') ? ` OFFSET ${obj.offset} ` : obj.limit ? 'OFFSET 0' : ''
+  const limitVal = toSafeNonNegativeInt(obj.limit, null)
+  const offsetVal = obj.hasOwnProperty('offset') ? toSafeNonNegativeInt(obj.offset, 0) : (obj.limit ? 0 : null)
+  const limit = limitVal !== null ? ` LIMIT ${limitVal} ` : ''
+  const offset = offsetVal !== null ? ` OFFSET ${offsetVal} ` : ''
   const orderBy = orderByFn(obj)
   const values = obj.values || []
   const objJoin = obj.joins || []
@@ -166,35 +244,16 @@ connection.results = async (obj) => {
   const wheres = whereObj.where
   const arr = whereObj.arr
 
-  // --- OPTIMIZATION: Fast count for count(id) as count ---
-  if (select.trim().toLowerCase() === 'count(id) as count' && !wheres) {
-    // No filter, use fast count from pg_class
-    const sql = `SELECT reltuples::bigint AS count FROM pg_class WHERE relname = '${table}'`;
-    try {
-      const start = Date.now();
-      const result = await pool.query(sql);
-      const elapsed = Date.now() - start;
-      console.log(`[zet-lib] Fast count for ${table}: ${elapsed}ms`);
-      return result.rows;
-    } catch (e) {
-      console.log(sql)
-      console.log(e.toString())
-    }
-  }
-
-  const sql = `SELECT ${select} FROM  "${table}" ${join} ${wheres} ${statement} ${orderBy} ${limit}  ${offset}`
+  const sql = `SELECT ${select} FROM "${table}" ${join} ${wheres} ${statement} ${orderBy} ${limit} ${offset}`.replace(/\s+/g, ' ').trim()
   try {
-    const start = Date.now();
+    const start = Date.now()
     const result = await pool.query(sql, arr.length ? arr : values.length ? values : null)
-    const elapsed = Date.now() - start;
-    /*if (select.trim().toLowerCase() === 'count(id) as count') {
-      console.log(`[zet-lib] Count query for ${table}: ${elapsed}ms`);
-    }*/
     return !result.rows ? [] : result.rows
   } catch (e) {
     console.log(sql)
     console.log(arr)
     console.log(e.toString())
+    throw e
   }
 }
 
@@ -229,25 +288,26 @@ connection.result = async (obj) => {
 }
 
 connection.insert = async (obj) => {
-  let result
-  const table = obj.table
-  const data = obj.data
+  const table = sanitizeTableName(obj.table || '')
+  if (!table) throw new Error('Table name is required for insert')
+  const data = { ...obj.data }
+  const returning = sanitizeReturning(data.returning || 'RETURNING *')
+  delete data.returning
   let increment = 1
   const datas = []
   const values = []
   const arr = []
-  const returning = data.returning || 'RETURNING *'
-  delete data.returning
   for (const key in data) {
-    datas.push(key)
-    values.push(`$${increment}`)
-    arr.push(data[key])
-    increment++
+    const col = sanitizeColumnName(key)
+    if (col) {
+      datas.push(col)
+      values.push(`$${increment}`)
+      arr.push(data[key])
+      increment++
+    }
   }
-  const sql = `INSERT INTO "${table}" ("${datas.join('","')}")  VALUES (${values.join(',')})  ${returning}`
-  /* console.log("ON INSERT " + sql)
-     console.log(arr)
- */
+  if (datas.length === 0) throw new Error('At least one valid column is required for insert')
+  const sql = `INSERT INTO "${table}" ("${datas.join('","')}") VALUES (${values.join(',')}) ${returning}`
 
   try {
     const results = await pool.query(sql, arr)
@@ -261,45 +321,59 @@ connection.insert = async (obj) => {
 }
 
 connection.update = async (obj) => {
-  const table = obj.table
-  const data = obj.data
-  const returning = data.returning || 'RETURNING *'
+  const table = sanitizeTableName(obj.table || '')
+  if (!table) throw new Error('Table name is required for update')
+  const data = { ...obj.data }
+  const returning = sanitizeReturning(data.returning || 'RETURNING *')
   delete data.returning
 
   const where = obj.where || {}
-  //[{field:"your_field",option:"=>",value:"12",operator:"AND"}]
-  let whereArray = obj.whereArray || []
-  const arr = [],
-    dataArr = []
+  const whereArray = obj.whereArray || []
+  const arr = []
+  const dataArr = []
   let wherequery = []
   let increment = 1
-  for (let key in data) {
-    dataArr.push(` "${key}" = $${increment}`)
-    arr.push(data[key])
-    increment++
+
+  for (const key in data) {
+    const col = sanitizeColumnName(key)
+    if (col) {
+      dataArr.push(`"${col}" = $${increment}`)
+      arr.push(data[key])
+      increment++
+    }
   }
-  for (var key in where) {
-    wherequery.push(` "${key}" =  $${increment}`)
-    arr.push(where[key])
-    increment++
+  if (dataArr.length === 0) throw new Error('At least one valid column is required for update')
+
+  for (const key in where) {
+    const col = sanitizeColumnName(key)
+    if (col) {
+      wherequery.push(`"${col}" = $${increment}`)
+      arr.push(where[key])
+      increment++
+    }
   }
-  wherequery = arr.length ? wherequery.join(' AND ') : ''
+  wherequery = wherequery.length ? wherequery.join(' AND ') : ''
+
   if (whereArray.length) {
     let andOr = wherequery ? ' AND ' : ''
     whereArray.forEach((item, index) => {
       if (index > 0) andOr = ''
-      const operator = !item.operator ? ' AND ' : item.operator
-      const field = item.field.indexOf('.') > -1 ? item.field : `"${item.field}"`
-      wherequery += `${andOr} ${field} ${item.option} $${increment} ${operator}`
-      arr.push(item.value)
-      increment++
+      const field = sanitizeWhereField(item.field)
+      const option = sanitizeWhereOption(item.option)
+      const connector = sanitizeWhereConnector(item.operator)
+      if (field && option) {
+        wherequery += `${andOr} ${field} ${option} $${increment} ${connector}`
+        arr.push(item.value)
+        increment++
+      }
     })
-    wherequery = wherequery.slice(0, -5)
+    if (wherequery.endsWith(' AND ')) wherequery = wherequery.slice(0, -5)
+    else if (wherequery.endsWith(' OR ')) wherequery = wherequery.slice(0, -4)
   }
-  const wheres = arr.length ? ' WHERE ' + wherequery : ''
-  const sql = `UPDATE "${table}" SET ${dataArr.join(', ')} ${wheres} ${returning}`
-  /* console.log(sql);
-      console.log(arr);*/
+
+  const wheres = wherequery ? ' WHERE ' + wherequery : ''
+  const sql = `UPDATE "${table}" SET ${dataArr.join(', ')}${wheres} ${returning}`
+
   try {
     const result = await pool.query(sql, arr)
     return result.rows[0]
@@ -312,21 +386,23 @@ connection.update = async (obj) => {
 }
 
 connection.delete = async (obj) => {
-  const table = obj.table
+  const table = sanitizeTableName(obj.table || '')
+  if (!table) throw new Error('Table name is required for delete')
   const where = obj.where || {}
-  let arr = [],
-    wherequery = []
+  const arr = []
+  const wherequery = []
   let increment = 1
   for (const key in where) {
-    wherequery.push(` "${key}" = $${increment}`)
-    arr.push(where[key])
-    increment++
+    const col = sanitizeColumnName(key)
+    if (col) {
+      wherequery.push(`"${col}" = $${increment}`)
+      arr.push(where[key])
+      increment++
+    }
   }
-  wherequery = arr.length ? wherequery.join(' AND ') : ''
-  const wheres = arr.length ? ' WHERE ' + wherequery : ''
-  const sql = `DELETE FROM "${table}" ${wheres} RETURNING *`
-  /*console.log(sql);
-    console.log(arr)*/
+  const whereClause = wherequery.length ? wherequery.join(' AND ') : ''
+  const wheres = whereClause ? ' WHERE ' + whereClause : ''
+  const sql = `DELETE FROM "${table}"${wheres} RETURNING *`
   try {
     return await pool.query(sql, arr)
   } catch (e) {
@@ -346,7 +422,7 @@ connection.insertData = async(tableName, data) => {
     }
 
     pgPool = new Pool(configPG);
-    
+
     const columns = Object.keys(data);
     if (columns.length === 0) {
       throw new Error('No columns found in the data object');
@@ -381,7 +457,7 @@ connection.deleteData = async(tableName, where) => {
     }
 
     pgPool = new Pool(configPG);
-    
+
     const whereColumns = Object.keys(where);
     if (whereColumns.length === 0) {
       throw new Error('No where conditions provided for delete');
@@ -417,13 +493,13 @@ connection.insertMultipleRecords = async(tableName,records) => {
     }
 
     pgPool = new Pool(configPG);
-    
+
     // Validasi bahwa semua records memiliki struktur yang sama
     const firstRecord = records[0];
     if (!firstRecord || typeof firstRecord !== 'object') {
       throw new Error('First record is invalid or empty');
     }
-    
+
     const columns = Object.keys(firstRecord);
     if (columns.length === 0) {
       throw new Error('No columns found in the first record');
@@ -444,7 +520,7 @@ connection.insertMultipleRecords = async(tableName,records) => {
     const placeholders = records.map((_, rowIndex) =>
         `(${columns.map((_, colIndex) => `$${rowIndex * columns.length + colIndex + 1}`).join(',')})`
     ).join(',');
-    
+
     // Create the INSERT query
     const insertQuery = `
             INSERT INTO "${tableName}" (${columns.map(col => `"${col}"`).join(',')})

package/lib/views/zgenerator/routerApp.ejs

@@ -1,359 +1,359 @@
-const router = require('express').Router();
-const {csrf} = require('zet-lib');
-const csrfProtection = csrf({cookie: true});
-const {Util, access, connection, moduleLib, zDebug, zRoute, zRole, zDataTable, zForm} = require('zet-lib');
-const MYMODEL = require('./../models/[[[TABLE_NAME]]]');
-
-router.get('/', async (req, res) => {
-    await zRoute.attributeData(res, MYMODEL);
-    let dataTable = new zDataTable(res.locals);
-    dataTable.filterMODEL = await zRoute.dataTableFilterSync(req,res, MYMODEL, res.locals.gridFilter);
-    const levels = zRole.myLevel(req, res, MYMODEL.table);
-    dataTable.levels = levels;
-    res.render(`layouts/${layout}`, {
-        dataTable: dataTable,
-        levels : levels,
-        titleHeader: `<strong class="text text-info">${MYMODEL.title}</strong>`,
-        breadcrumb : zForm.breadcrumbIndex(),
-        myModal : zForm.modal({
-        attributeData: res.locals.attributeData,
-        visibles: res.locals.visibles,
-        invisibles: res.locals.invisibles,
-        routeName: MYMODEL.table,
-        }, LANGUAGE),
-        renderHead: `${MYMODEL.routeName}/indexcss.ejs`,
-        renderBody: `${MYMODEL.routeName}/index.ejs`,
-        renderEnd: `${MYMODEL.routeName}/indexjs.ejs`
-    });
-});
-
-router.post('/list', async (req, res) => {
-    const data = await zRoute.listData(req, res, MYMODEL, zRole);
-    res.json(data);
-});
-
-router.get('/create', csrfProtection, async(req, res) => {
-    let data = MYMODEL.datas;
-    const zForms = await zRoute.formsFieldSync(req, res, MYMODEL, data);
-    res.render(`layouts/${layout}`, {
-        data: data,
-        zForms: zForms,
-        titleHeader: `${LANGUAGE['form_create']} : <strong><a href="/${MYMODEL.routeName}">${MYMODEL.title}</a></strong>`,
-        csrfToken: req.csrfToken(),
-        breadcrumb : zForm.breadcrumbCreate(MYMODEL.routeName),
-        renderBody: `${MYMODEL.routeName}/create.ejs`,
-        renderEnd: `${MYMODEL.routeName}/createjs.ejs`
-    });
-});
-
-router.post('/create', csrfProtection, async (req, res) => {
-    let json = Util.jsonSuccess(LANGUAGE['data_saved']);
-    try {
-        let data = zRoute.post(req,res, MYMODEL)[MYMODEL.routeName];
-        const validator = zRoute.validator(data, MYMODEL);
-        if(validator.status == 0) return res.json(validator.message);
-        const result = await zRoute.insertSQL(req, res, MYMODEL.table, data);
-        json.data=result;
-    } catch (err) {
-        if(Object.hasOwn(err,"sqlMessage")){
-            json = Util.flashError(err.sqlMessage);
-        } else {
-            json = Util.flashError(err.toString());
-        }
-        zDebug(req, res, err);
-    }
-    res.json(json);
-});
-
-router.get('/update/:id', csrfProtection, async (req, res) => {
-    const id = parseInt(req.params.id);
-    const results = await connection.results({
-        select:zRoute.selectData(MYMODEL),
-        table: MYMODEL.table,
-        where: {
-            id: id,
-            company_id: res.locals.companyId
-        }
-    });
-    if (results.length == 0) {
-        req.session.sessionFlash = Util.flashError(LANGUAGE['data_not_found']);
-        return res.redirect('/' + MYMODEL.routeName);
-    }
-    let data = results[0];
-    const zForms = await zRoute.formsFieldSync(req, res, MYMODEL, data);
-    res.render(`layouts/${layout}`, {
-        data: data,
-        zForms: zForms,
-        titleHeader: `${LANGUAGE['form_update']} : <strong><a href="/${MYMODEL.routeName}">${MYMODEL.title}</a></strong>`,
-        csrfToken: req.csrfToken(),
-        breadcrumb : zForm.breadcrumbUpdate(MYMODEL.routeName, id),
-        renderBody: `${MYMODEL.routeName}/update.ejs`,
-        renderEnd: `${MYMODEL.routeName}/updatejs.ejs`,
-    });
-});
-
-router.post('/update/:id', csrfProtection, async (req, res) => {
-    let json = Util.jsonSuccess(LANGUAGE['data_saved']);
-    try {
-        const id = parseInt(req.params.id);
-        let data = zRoute.post(req,res, MYMODEL)[MYMODEL.routeName];
-        const validator = zRoute.validator(data, MYMODEL);
-        if(validator.status == 0) return res.json(validator.message);
-        const result = await zRoute.updateSQL(req, res,MYMODEL.table, data, {id:id});
-        json.data=result;
-    } catch (err) {
-        console.log(err)
-        if(Object.hasOwn(err,"sqlMessage")){
-            json = Util.flashError(err.sqlMessage);
-        } else {
-            json = Util.flashError(err.toString());
-        }
-        zDebug(req, res, err)
-    }
-    res.json(json);
-});
-
-router.delete('/delete', async (req, res) => {
-    const id = req.body.id;
-    let json = Util.jsonSuccess(LANGUAGE['data_delete']);
-    try {
-        await zRoute.deleteSQL(MYMODEL.table, id, res.locals.companyId);
-    } catch (err) {
-        json = Util.flashError(err.toString());
-        zDebug(req, res, err)
-    }
-    res.json(json);
-});
-
-router.get('/view/:id', async (req, res) => {
-    await zRoute.attributeData(res, MYMODEL);
-    const id = req.params.id;
-    let data = {};
-    let zForms = {};
-    try {
-        const results = await connection.results({select:zRoute.selectData(MYMODEL),table:MYMODEL.table,where:{id:id}});
-        if (results.length == 0) {
-            req.session.sessionFlash = Util.flashError(LANGUAGE['data_not_found']);
-            return res.redirect('/' + MYMODEL.routeName);
-        }
-        data = results[0];
-        zForms = await zRoute.viewFormsSync(req, res, MYMODEL, data);
-    } catch (err){
-        zDebug(req, res, err);
-        res.send("Err");
-    }
-    res.render(`layouts/${layout}`, {
-        data: data,
-        Util:Util,
-        zForms:zForms,
-        titleHeader: `View : <strong><a href="/${MYMODEL.routeName}">${MYMODEL.title}</a></strong>`,
-        breadcrumb : zForm.breadcrumbView(MYMODEL.routeName),
-        levels: zRole.myLevel(req, res, MYMODEL.table),
-        renderBody: `${MYMODEL.routeName}/view.ejs`
-    });
-});
-
-router.get('/excel-query', async (req,res) => {
-    await zRoute.excelQuery(req, res, MYMODEL);
-});
-
-router.get('/excel', async (req, res) => {
-    const fields = MYMODEL.keysExcel;
-    const results = await connection.results({
-        table: MYMODEL.table,
-        where: {company_id: res.locals.companyId},
-        orderBy: ['id', 'DESC']
-    });
-    await zRoute.excel(req, res, MYMODEL, fields, results);
-});
-
-router.get('/sample', async (req, res) => {
-    let fields = [];
-    for (let i = 0; i < MYMODEL.keysExcel.length; i++) {
-        if (!Util.in_array(MYMODEL.keysExcel[i], Util.nots)) {
-            fields.push(MYMODEL.keysExcel[i]);
-        }
-    }
-    const results = await connection.results({
-        table:MYMODEL.table,
-        where:{
-            company_id:res.locals.companyId
-        },
-        orderBy:["id","desc"], limit:10
-    });
-    let callback=(result,field)=> {
-        return MYMODEL.widgets[field] && MYMODEL.widgets[field].name == 'datepicker' ? Util.dateSql(result[field]) : result[field];
-    };
-    await zRoute.excel(req, res, MYMODEL, fields, results, callback);
-});
-
-router.get('/import',csrfProtection, async (req, res) => {
-    const room = res.locals.token;
-    res.render(`layouts/${layout}`, {
-        room: room,
-        titleHeader: `Import / Upload data : <strong><a href="/${MYMODEL.routeName}">${MYMODEL.title}</a></strong>`,
-        csrfToken: req.csrfToken(),
-        breadcrumb : zForm.breadcrumbImport(MYMODEL.routeName),
-        renderBody: `${MYMODEL.routeName}/import.ejs`,
-        renderEnd: `${MYMODEL.routeName}/importjs.ejs`
-    });
-});
-
-
-router.post('/import', async(req, res) => {
-    res.json(await zRoute.import(req,res,MYMODEL));
-});
-
-router.get('/approval/:id', async (req, res) => {
-    await zRoute.attributeData(res, MYMODEL);
-    const id = req.params.id;
-    let data = {};
-    let data2 = {};
-    let zForms = {};
-    let zForms2 = {};
-    let result = {};
-    try {
-        result = await connection.result({table: MYMODEL.table, where: {id: id}});
-        if (!result.id) {
-            req.session.sessionFlash = Util.flashError(LANGUAGE['data_not_found']);
-            return res.redirect('/' + MYMODEL.routeName);
-        }
-        data=result;
-        moduleLib.editor(req, res);
-        zForms = await zRoute.viewFormsSync(req, res, MYMODEL, result);
-        const contentScript = `$("#submit_draft").on("click", function () {$("#status").val(1);ajaxPost("/zzapproval",$("#form-group").serializeArray(), function (data) {
-            if (data.status == 0) {
-                toastr.error(data.message, data.title);
-            } else {
-                toastr.success(data.title, data.message);
-            }
-        });});
-        $("#submit").on("click", function () {
-            $('[name="zapprovals[status]"]').val(2);
-            ajaxPost("/zzapproval",$("#form-group").serializeArray(), function (data) {
-                if (data.status == 0) {
-                    toastr.error(data.message, data.title);
-                } else {
-                    toastr.success(data.title, data.message);
-                    location.href = "";
-                }
-            });
-        });
-    `;
-        await moduleLib.addScript(req, res, contentScript);
-        const MODEL_APROVALS = require("./../models/zapprovals");
-        const rows = await connection.results({
-            table: "zapprovals",
-            where: {table: MYMODEL.table, company_id: res.locals.companyId, id_data: id}
-        });
-        if (rows.length) {
-            data2 = rows[0];
-        } else {
-            let obj = {};
-            obj.token = Util.uuid();
-            obj.status = 1;
-            obj.table = MYMODEL.table;
-            obj.company_id = res.locals.companyId;
-            obj.id_data = id;
-            obj.created_by = res.locals.userId;
-            obj.updated_by = res.locals.userId;
-            obj.created_at = Util.now();
-            let zfields = await connection.result({table: "zfields", where: {table: MYMODEL.table}});
-            let jsonApproval = zfields.approval_json || {}
-            obj.template = jsonApproval.content || {}
-            let title = jsonApproval.title;
-            if (title) {
-                let titleData = title;
-                for (var key in data) {
-                    titleData = Util.replaceAll(titleData, "{{" + key + "}}", data[key])
-                }
-                obj.title = titleData
-            }
-            if (jsonApproval.hasOwnProperty("approvers")) {
-                obj.approvers = JSON.stringify(jsonApproval.approvers);
-                obj.knowings = JSON.stringify(jsonApproval.knowings);
-                obj.type = 1;
-            }
-            //insert default data
-            await connection.insert({table: "zapprovals", data: obj});
-            data2 = obj;
-        }
-        zForms2 = await zRoute.formsFieldSync(req, res, MODEL_APROVALS, data2);
-    } catch (err) {
-        zDebug(req, res, err);
-        res.send("Err");
-    }
-    res.render(`layouts/${layout}`, {
-        zForms: zForms,
-        zForms2: zForms2,
-        data: result,
-        result:result,
-        data2: data2,
-        Util: Util,
-        levels: zRole.myLevel(req, res, MYMODEL.table),
-        breadcrumb : zForm.breadcrumbApproval(MYMODEL.routeName, id),
-        renderBody: `${MYMODEL.routeName}/approval.ejs`
-    });
-});
-
-router.get('/preview/:token', async (req, res) => {
-    let token = req.params.token;
-    let data = {}, data2 = {};
-    let template = "";
-    let footers = "";
-    try {
-        let zfields = await connection.result({table: "zfields", where: {table: MYMODEL.table}});
-        let jsonApproval = zfields.approval_json || {}
-        let mytemplate = jsonApproval.content || {}
-        let results = await connection.results({table: "zapprovals", where: {token: token}});
-        if (results.length == 0) {
-            req.session.sessionFlash = Util.flashError(LANGUAGE['data_not_found']);
-            return res.redirect('/' + MYMODEL.routeName);
-        }
-        if(results[0].status == 1){
-            await connection.update({
-                table : "zapprovals",
-                data: {
-                    template : mytemplate
-                },
-                where : {
-                    token:token
-                }
-            })
-            results = await connection.results({table: "zapprovals", where: {token: token}});
-        }
-        let MYMODEL2 = require("./../models/zapprovals")
-        data = await zRoute.viewTable(req, res, MYMODEL2, results[0], true);
-        let row = await connection.result({table: results[0].table, where: {id: results[0].id_data}});
-        data2 = await zRoute.viewTable(req, res, MYMODEL, row, true);
-        template = data.template;
-        let title = data.title || ""
-        for (var key in data2) {
-            template = Util.replaceAll(template, "{{" + key + "}}", data2[key])
-            title = Util.replaceAll(title, "{{" + key + "}}", data2[key])
-        }
-        data.title = title;
-        var details = await connection.results({table: "zapprovals_details", where: {title_id: results[0].id}});
-        if (details.length) {
-            footers = await zRoute.approversFooter(details);
-        }
-    } catch (err) {
-        zDebug(req, res, err);
-        res.send("Err");
-    }
-    res.render(`layouts/blank`, {
-        template: template,
-        data: data,
-        footers: footers,
-        Util: Util,
-        details: details,
-        renderBody: 'index/zapprovals_preview.ejs'
-    });
-});
-
-router.post('/grid', access, zRoute.postGrid);
-router.post('/reload', access, zRoute.postGridReload);
-router.post('/chains', access, zRoute.chains);
-router.post('/get_attributes',access, zRoute.getAttributes);
-
-module.exports = router;
+const router = require('express').Router();
+const {csrf} = require('zet-lib');
+const csrfProtection = csrf({cookie: true});
+const {Util, access, connection, moduleLib, zDebug, zRoute, zRole, zDataTable, zForm} = require('zet-lib');
+const MYMODEL = require('./../models/[[[TABLE_NAME]]]');
+
+router.get('/', async (req, res) => {
+    await zRoute.attributeData(res, MYMODEL);
+    let dataTable = new zDataTable(res.locals);
+    dataTable.filterMODEL = await zRoute.dataTableFilterSync(req,res, MYMODEL, res.locals.gridFilter);
+    const levels = zRole.myLevel(req, res, MYMODEL.table);
+    dataTable.levels = levels;
+    res.render(`layouts/${layout}`, {
+        dataTable: dataTable,
+        levels : levels,
+        titleHeader: `<strong class="text text-info">${MYMODEL.title}</strong>`,
+        breadcrumb : zForm.breadcrumbIndex(),
+        myModal : zForm.modal({
+        attributeData: res.locals.attributeData,
+        visibles: res.locals.visibles,
+        invisibles: res.locals.invisibles,
+        routeName: MYMODEL.table,
+        }, LANGUAGE),
+        renderHead: `${MYMODEL.routeName}/indexcss.ejs`,
+        renderBody: `${MYMODEL.routeName}/index.ejs`,
+        renderEnd: `${MYMODEL.routeName}/indexjs.ejs`
+    });
+});
+
+router.post('/list', async (req, res) => {
+    const data = await zRoute.listData(req, res, MYMODEL, zRole);
+    res.json(data);
+});
+
+router.get('/create', csrfProtection, async(req, res) => {
+    let data = MYMODEL.datas;
+    const zForms = await zRoute.formsFieldSync(req, res, MYMODEL, data);
+    res.render(`layouts/${layout}`, {
+        data: data,
+        zForms: zForms,
+        titleHeader: `${LANGUAGE['form_create']} : <strong><a href="/${MYMODEL.routeName}">${MYMODEL.title}</a></strong>`,
+        csrfToken: req.csrfToken(),
+        breadcrumb : zForm.breadcrumbCreate(MYMODEL.routeName),
+        renderBody: `${MYMODEL.routeName}/create.ejs`,
+        renderEnd: `${MYMODEL.routeName}/createjs.ejs`
+    });
+});
+
+router.post('/create', csrfProtection, async (req, res) => {
+    let json = Util.jsonSuccess(LANGUAGE['data_saved']);
+    try {
+        let data = zRoute.post(req,res, MYMODEL)[MYMODEL.routeName];
+        const validator = zRoute.validator(data, MYMODEL);
+        if(validator.status == 0) return res.json(validator.message);
+        const result = await zRoute.insertSQL(req, res, MYMODEL.table, data);
+        json.data=result;
+    } catch (err) {
+        if(Object.hasOwn(err,"sqlMessage")){
+            json = Util.flashError(err.sqlMessage);
+        } else {
+            json = Util.flashError(err.toString());
+        }
+        zDebug(req, res, err);
+    }
+    res.json(json);
+});
+
+router.get('/update/:id', csrfProtection, async (req, res) => {
+    const id = parseInt(req.params.id);
+    const results = await connection.results({
+        select:zRoute.selectData(MYMODEL),
+        table: MYMODEL.table,
+        where: {
+            id: id,
+            company_id: res.locals.companyId
+        }
+    });
+    if (results.length == 0) {
+        req.session.sessionFlash = Util.flashError(LANGUAGE['data_not_found']);
+        return res.redirect('/' + MYMODEL.routeName);
+    }
+    let data = results[0];
+    const zForms = await zRoute.formsFieldSync(req, res, MYMODEL, data);
+    res.render(`layouts/${layout}`, {
+        data: data,
+        zForms: zForms,
+        titleHeader: `${LANGUAGE['form_update']} : <strong><a href="/${MYMODEL.routeName}">${MYMODEL.title}</a></strong>`,
+        csrfToken: req.csrfToken(),
+        breadcrumb : zForm.breadcrumbUpdate(MYMODEL.routeName, id),
+        renderBody: `${MYMODEL.routeName}/update.ejs`,
+        renderEnd: `${MYMODEL.routeName}/updatejs.ejs`,
+    });
+});
+
+router.post('/update/:id', csrfProtection, async (req, res) => {
+    let json = Util.jsonSuccess(LANGUAGE['data_saved']);
+    try {
+        const id = parseInt(req.params.id);
+        let data = zRoute.post(req,res, MYMODEL)[MYMODEL.routeName];
+        const validator = zRoute.validator(data, MYMODEL);
+        if(validator.status == 0) return res.json(validator.message);
+        const result = await zRoute.updateSQL(req, res,MYMODEL.table, data, {id:id});
+        json.data=result;
+    } catch (err) {
+        console.log(err)
+        if(Object.hasOwn(err,"sqlMessage")){
+            json = Util.flashError(err.sqlMessage);
+        } else {
+            json = Util.flashError(err.toString());
+        }
+        zDebug(req, res, err)
+    }
+    res.json(json);
+});
+
+router.delete('/delete', async (req, res) => {
+    const id = req.body.id;
+    let json = Util.jsonSuccess(LANGUAGE['data_delete']);
+    try {
+        await zRoute.deleteSQL(MYMODEL.table, id, res.locals.companyId);
+    } catch (err) {
+        json = Util.flashError(err.toString());
+        zDebug(req, res, err)
+    }
+    res.json(json);
+});
+
+router.get('/view/:id', async (req, res) => {
+    await zRoute.attributeData(res, MYMODEL);
+    const id = req.params.id;
+    let data = {};
+    let zForms = {};
+    try {
+        const results = await connection.results({select:zRoute.selectData(MYMODEL),table:MYMODEL.table,where:{id:id}});
+        if (results.length == 0) {
+            req.session.sessionFlash = Util.flashError(LANGUAGE['data_not_found']);
+            return res.redirect('/' + MYMODEL.routeName);
+        }
+        data = results[0];
+        zForms = await zRoute.viewFormsSync(req, res, MYMODEL, data);
+    } catch (err){
+        zDebug(req, res, err);
+        res.send("Err");
+    }
+    res.render(`layouts/${layout}`, {
+        data: data,
+        Util:Util,
+        zForms:zForms,
+        titleHeader: `View : <strong><a href="/${MYMODEL.routeName}">${MYMODEL.title}</a></strong>`,
+        breadcrumb : zForm.breadcrumbView(MYMODEL.routeName),
+        levels: zRole.myLevel(req, res, MYMODEL.table),
+        renderBody: `${MYMODEL.routeName}/view.ejs`
+    });
+});
+
+router.get('/excel-query', async (req,res) => {
+    await zRoute.excelQuery(req, res, MYMODEL);
+});
+
+router.get('/excel', async (req, res) => {
+    const fields = MYMODEL.keysExcel;
+    const results = await connection.results({
+        table: MYMODEL.table,
+        where: {company_id: res.locals.companyId},
+        orderBy: ['id', 'DESC']
+    });
+    await zRoute.excel(req, res, MYMODEL, fields, results);
+});
+
+router.get('/sample', async (req, res) => {
+    let fields = [];
+    for (let i = 0; i < MYMODEL.keysExcel.length; i++) {
+        if (!Util.in_array(MYMODEL.keysExcel[i], Util.nots)) {
+            fields.push(MYMODEL.keysExcel[i]);
+        }
+    }
+    const results = await connection.results({
+        table:MYMODEL.table,
+        where:{
+            company_id:res.locals.companyId
+        },
+        orderBy:["id","desc"], limit:10
+    });
+    let callback=(result,field)=> {
+        return MYMODEL.widgets[field] && MYMODEL.widgets[field].name == 'datepicker' ? Util.dateSql(result[field]) : result[field];
+    };
+    await zRoute.excel(req, res, MYMODEL, fields, results, callback);
+});
+
+router.get('/import',csrfProtection, async (req, res) => {
+    const room = res.locals.token;
+    res.render(`layouts/${layout}`, {
+        room: room,
+        titleHeader: `Import / Upload data : <strong><a href="/${MYMODEL.routeName}">${MYMODEL.title}</a></strong>`,
+        csrfToken: req.csrfToken(),
+        breadcrumb : zForm.breadcrumbImport(MYMODEL.routeName),
+        renderBody: `${MYMODEL.routeName}/import.ejs`,
+        renderEnd: `${MYMODEL.routeName}/importjs.ejs`
+    });
+});
+
+
+router.post('/import', async(req, res) => {
+    res.json(await zRoute.import(req,res,MYMODEL));
+});
+
+router.get('/approval/:id', async (req, res) => {
+    await zRoute.attributeData(res, MYMODEL);
+    const id = req.params.id;
+    let data = {};
+    let data2 = {};
+    let zForms = {};
+    let zForms2 = {};
+    let result = {};
+    try {
+        result = await connection.result({table: MYMODEL.table, where: {id: id}});
+        if (!result.id) {
+            req.session.sessionFlash = Util.flashError(LANGUAGE['data_not_found']);
+            return res.redirect('/' + MYMODEL.routeName);
+        }
+        data=result;
+        moduleLib.editor(req, res);
+        zForms = await zRoute.viewFormsSync(req, res, MYMODEL, result);
+        const contentScript = `$("#submit_draft").on("click", function () {$("#status").val(1);ajaxPost("/zzapproval",$("#form-group").serializeArray(), function (data) {
+            if (data.status == 0) {
+                toastr.error(data.message, data.title);
+            } else {
+                toastr.success(data.title, data.message);
+            }
+        });});
+        $("#submit").on("click", function () {
+            $('[name="zapprovals[status]"]').val(2);
+            ajaxPost("/zzapproval",$("#form-group").serializeArray(), function (data) {
+                if (data.status == 0) {
+                    toastr.error(data.message, data.title);
+                } else {
+                    toastr.success(data.title, data.message);
+                    location.href = "";
+                }
+            });
+        });
+    `;
+        await moduleLib.addScript(req, res, contentScript);
+        const MODEL_APROVALS = require("./../models/zapprovals");
+        const rows = await connection.results({
+            table: "zapprovals",
+            where: {table: MYMODEL.table, company_id: res.locals.companyId, id_data: id}
+        });
+        if (rows.length) {
+            data2 = rows[0];
+        } else {
+            let obj = {};
+            obj.token = Util.uuid();
+            obj.status = 1;
+            obj.table = MYMODEL.table;
+            obj.company_id = res.locals.companyId;
+            obj.id_data = id;
+            obj.created_by = res.locals.userId;
+            obj.updated_by = res.locals.userId;
+            obj.created_at = Util.now();
+            let zfields = await connection.result({table: "zfields", where: {table: MYMODEL.table}});
+            let jsonApproval = zfields.approval_json || {}
+            obj.template = jsonApproval.content || {}
+            let title = jsonApproval.title;
+            if (title) {
+                let titleData = title;
+                for (var key in data) {
+                    titleData = Util.replaceAll(titleData, "{{" + key + "}}", data[key])
+                }
+                obj.title = titleData
+            }
+            if (jsonApproval.hasOwnProperty("approvers")) {
+                obj.approvers = JSON.stringify(jsonApproval.approvers);
+                obj.knowings = JSON.stringify(jsonApproval.knowings);
+                obj.type = 1;
+            }
+            //insert default data
+            await connection.insert({table: "zapprovals", data: obj});
+            data2 = obj;
+        }
+        zForms2 = await zRoute.formsFieldSync(req, res, MODEL_APROVALS, data2);
+    } catch (err) {
+        zDebug(req, res, err);
+        res.send("Err");
+    }
+    res.render(`layouts/${layout}`, {
+        zForms: zForms,
+        zForms2: zForms2,
+        data: result,
+        result:result,
+        data2: data2,
+        Util: Util,
+        levels: zRole.myLevel(req, res, MYMODEL.table),
+        breadcrumb : zForm.breadcrumbApproval(MYMODEL.routeName, id),
+        renderBody: `${MYMODEL.routeName}/approval.ejs`
+    });
+});
+
+router.get('/preview/:token', async (req, res) => {
+    let token = req.params.token;
+    let data = {}, data2 = {};
+    let template = "";
+    let footers = "";
+    try {
+        let zfields = await connection.result({table: "zfields", where: {table: MYMODEL.table}});
+        let jsonApproval = zfields.approval_json || {}
+        let mytemplate = jsonApproval.content || {}
+        let results = await connection.results({table: "zapprovals", where: {token: token}});
+        if (results.length == 0) {
+            req.session.sessionFlash = Util.flashError(LANGUAGE['data_not_found']);
+            return res.redirect('/' + MYMODEL.routeName);
+        }
+        if(results[0].status == 1){
+            await connection.update({
+                table : "zapprovals",
+                data: {
+                    template : mytemplate
+                },
+                where : {
+                    token:token
+                }
+            })
+            results = await connection.results({table: "zapprovals", where: {token: token}});
+        }
+        let MYMODEL2 = require("./../models/zapprovals")
+        data = await zRoute.viewTable(req, res, MYMODEL2, results[0], true);
+        let row = await connection.result({table: results[0].table, where: {id: results[0].id_data}});
+        data2 = await zRoute.viewTable(req, res, MYMODEL, row, true);
+        template = data.template;
+        let title = data.title || ""
+        for (var key in data2) {
+            template = Util.replaceAll(template, "{{" + key + "}}", data2[key])
+            title = Util.replaceAll(title, "{{" + key + "}}", data2[key])
+        }
+        data.title = title;
+        var details = await connection.results({table: "zapprovals_details", where: {title_id: results[0].id}});
+        if (details.length) {
+            footers = await zRoute.approversFooter(details);
+        }
+    } catch (err) {
+        zDebug(req, res, err);
+        res.send("Err");
+    }
+    res.render(`layouts/blank`, {
+        template: template,
+        data: data,
+        footers: footers,
+        Util: Util,
+        details: details,
+        renderBody: 'index/zapprovals_preview.ejs'
+    });
+});
+
+router.post('/grid', access, zRoute.postGrid);
+router.post('/reload', access, zRoute.postGridReload);
+router.post('/chains', access, zRoute.chains);
+router.post('/get_attributes',access, zRoute.getAttributes);
+
+module.exports = router;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zet-lib",
-  "version": "3.3.0",
+  "version": "3.3.2",
   "description": "zet is a library that part of zet generator.",
   "engines": {
     "node": ">=18"