chore: release beta branch (#1033)

Author: VincentMolinie

CHANGELOG.md

@@ -1,3 +1,38 @@
+# [9.0.0-beta.4](https://github.com/ForestAdmin/forest-express-sequelize/compare/v9.0.0-beta.3...v9.0.0-beta.4) (2022-11-09)
+
+
+### Features
+
+* **chart:** add support for context variables inside SQL query ([#1028](https://github.com/ForestAdmin/forest-express-sequelize/issues/1028)) ([6bf678e](https://github.com/ForestAdmin/forest-express-sequelize/commit/6bf678ead766a202908c0bf8f5376e9c45d9ef6f))
+
+# [9.0.0-beta.3](https://github.com/ForestAdmin/forest-express-sequelize/compare/v9.0.0-beta.2...v9.0.0-beta.3) (2022-11-02)
+
+
+### Features
+
+* **chart:** add support for context variables used by Workspaces ([#1029](https://github.com/ForestAdmin/forest-express-sequelize/issues/1029)) ([dc3009a](https://github.com/ForestAdmin/forest-express-sequelize/commit/dc3009acf395292cf28a8d7b481d36f78bb9d829))
+
+# [9.0.0-beta.2](https://github.com/ForestAdmin/forest-express-sequelize/compare/v9.0.0-beta.1...v9.0.0-beta.2) (2022-10-28)
+
+
+### Bug Fixes
+
+* **chart:** improve security on chart and rename charts' properties ([#1027](https://github.com/ForestAdmin/forest-express-sequelize/issues/1027)) ([2e4c54e](https://github.com/ForestAdmin/forest-express-sequelize/commit/2e4c54e4b66295451e97c873b3cfa3043e1864e3))
+
+# [9.0.0-beta.1](https://github.com/ForestAdmin/forest-express-sequelize/compare/v8.5.14...v9.0.0-beta.1) (2022-10-28)
+
+
+### Bug Fixes
+
+* **security:** validate that smart action approvals are launched with the same parameters than the initial trigger ([#1026](https://github.com/ForestAdmin/forest-express-sequelize/issues/1026)) ([928865e](https://github.com/ForestAdmin/forest-express-sequelize/commit/928865e9299d1ef9680e9b33ce33ecd8f4c9d077))
+
+
+### BREAKING CHANGES
+
+* **security:** drop support of projects that are not using roles
+    
+Co-authored-by: Guillaume Gautreau <[email protected]>, Morgan Perre <[email protected]>
+
 ## [8.5.14](https://github.com/ForestAdmin/forest-express-sequelize/compare/v8.5.13...v8.5.14) (2022-10-25)
 
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "forest-express-sequelize",
   "description": "Official Express/Sequelize Liana for Forest",
-  "version": "8.5.14",
+  "version": "9.0.0-beta.4",
   "author": "Sandro Munda <[email protected]>",
   "contributors": [
     "Arnaud Besnier <[email protected]>",
@@ -28,7 +28,7 @@
     "@babel/runtime": "7.15.4",
     "bluebird": "2.9.25",
     "core-js": "3.6.5",
-    "forest-express": "9.5.6",
+    "forest-express": "10.0.0",
     "http-errors": "1.6.1",
     "lodash": "4.17.21",
     "moment": "2.29.4",

src/services/leaderboard-stat-getter.js

@@ -26,14 +26,15 @@ async function getSequelizeOptionsForModel(model, user, timezone) {
  * @param {import('sequelize').Model} childModel
  * @param {import('sequelize').Model} parentModel
  * @param {{
- *  label_field: string;
- *  aggregate: string;
- *  aggregate_field: string;
+ *  labelFieldName: string;
+ *  aggregator: string;
+ *  aggregateFieldName: string;
+ *  limit: number;
  * }} params
  */
 function LeaderboardStatGetter(childModel, parentModel, params, user) {
-  const labelField = params.label_field;
-  const aggregate = params.aggregate.toUpperCase();
+  const labelField = params.labelFieldName;
+  const aggregate = params.aggregator.toUpperCase();
   const { limit } = params;
   const childSchema = Schemas.schemas[childModel.name];
   const parentSchema = Schemas.schemas[parentModel.name];
@@ -44,7 +45,7 @@ function LeaderboardStatGetter(childModel, parentModel, params, user) {
   );
 
   const aggregateField = getAggregateField({
-    aggregateField: params.aggregate_field,
+    aggregateField: params.aggregateFieldName,
     parentSchema,
     parentModel,
   });

src/services/line-stat-getter.js

@@ -7,18 +7,18 @@ import QueryOptions from './query-options';
 
 function LineStatGetter(model, params, options, user) {
   const schema = Schemas.schemas[model.name];
-  const timeRange = params.time_range.toLowerCase();
+  const timeRange = params.timeRange.toLowerCase();
 
   function getAggregateField() {
     // NOTICE: As MySQL cannot support COUNT(table_name.*) syntax, fieldName cannot be '*'.
-    const fieldName = params.aggregate_field
+    const fieldName = params.aggregateFieldName
       || schema.primaryKeys[0]
       || schema.fields[0].field;
     return `${schema.name}.${Orm.getColumnName(schema, fieldName)}`;
   }
 
   function getGroupByDateField() {
-    return `${schema.name}.${Orm.getColumnName(schema, params.group_by_date_field)}`;
+    return `${schema.name}.${Orm.getColumnName(schema, params.groupByFieldName)}`;
   }
 
   const groupByDateField = getGroupByDateField();
@@ -133,7 +133,7 @@ ${groupByDateFieldFormated}), 'yyyy-MM-dd 00:00:00')`);
         'to_char',
         options.Sequelize.fn(
           'date_trunc',
-          params.time_range,
+          params.timeRange,
           options.Sequelize.literal(`"${getGroupByDateField().replace('.', '"."')}" at time zone '${params.timezone}'`),
         ),
         'YYYY-MM-DD 00:00:00',
@@ -181,7 +181,7 @@ ${groupByDateFieldFormated}), 'yyyy-MM-dd 00:00:00')`);
   function getAggregate() {
     return [
       options.Sequelize.fn(
-        params.aggregate.toLowerCase(),
+        params.aggregator.toLowerCase(),
         options.Sequelize.col(getAggregateField()),
       ),
       'value',
@@ -197,11 +197,11 @@ ${groupByDateFieldFormated}), 'yyyy-MM-dd 00:00:00')`);
   }
 
   this.perform = async () => {
-    const { filters, timezone } = params;
+    const { filter, timezone } = params;
     const scopeFilters = await scopeManager.getScopeForUser(user, model.name, true);
 
     const queryOptions = new QueryOptions(model, { includeRelations: true });
-    await queryOptions.filterByConditionTree(filters, timezone);
+    await queryOptions.filterByConditionTree(filter, timezone);
     await queryOptions.filterByConditionTree(scopeFilters, timezone);
 
     const sequelizeOptions = {

src/services/live-query-checker.js

@@ -19,10 +19,10 @@ function PieStatGetter(model, params, options, user) {
   let associationSchema;
   let field;
 
-  if (params.group_by_field.indexOf(':') === -1) {
-    field = _.find(schema.fields, (currentField) => currentField.field === params.group_by_field);
+  if (params.groupByFieldName.indexOf(':') === -1) {
+    field = _.find(schema.fields, (currentField) => currentField.field === params.groupByFieldName);
   } else {
-    associationSplit = params.group_by_field.split(':');
+    associationSplit = params.groupByFieldName.split(':');
     associationCollection = model.associations[associationSplit[0]].target.name;
     [, associationField] = associationSplit;
     associationSchema = Schemas.schemas[associationCollection];
@@ -33,22 +33,22 @@ function PieStatGetter(model, params, options, user) {
   }
 
   function getGroupByField() {
-    if (params.group_by_field.includes(':')) {
-      const [associationName, fieldName] = params.group_by_field.split(':');
+    if (params.groupByFieldName.includes(':')) {
+      const [associationName, fieldName] = params.groupByFieldName.split(':');
       return `${associationName}.${Orm.getColumnName(associationSchema, fieldName)}`;
     }
-    return `${schema.name}.${Orm.getColumnName(schema, params.group_by_field)}`;
+    return `${schema.name}.${Orm.getColumnName(schema, params.groupByFieldName)}`;
   }
 
   const groupByField = getGroupByField();
 
   function getAggregate() {
-    return params.aggregate.toLowerCase();
+    return params.aggregator.toLowerCase();
   }
 
   function getAggregateField() {
     // NOTICE: As MySQL cannot support COUNT(table_name.*) syntax, fieldName cannot be '*'.
-    const fieldName = params.aggregate_field
+    const fieldName = params.aggregateFieldName
       || schema.primaryKeys[0]
       || schema.fields[0].field;
     return `${schema.name}.${Orm.getColumnName(schema, fieldName)}`;
@@ -81,11 +81,11 @@ function PieStatGetter(model, params, options, user) {
   }
 
   this.perform = async () => {
-    const { filters, timezone } = params;
+    const { filter, timezone } = params;
     const scopeFilters = await scopeManager.getScopeForUser(user, model.name, true);
 
     const queryOptions = new QueryOptions(model, { includeRelations: true });
-    await queryOptions.filterByConditionTree(filters, timezone);
+    await queryOptions.filterByConditionTree(filter, timezone);
     await queryOptions.filterByConditionTree(scopeFilters, timezone);
 
     const sequelizeOptions = {

src/services/pie-stat-getter.js

@@ -6,7 +6,6 @@ import QueryUtils from '../utils/query';
 import SequelizeCompatibility from '../utils/sequelize-compatibility';
 import { ErrorHTTP422 } from './errors';
 import FiltersParser from './filters-parser';
-import LiveQueryChecker from './live-query-checker';
 import PrimaryKeysManager from './primary-keys-manager';
 import QueryBuilder from './query-builder';
 import SearchBuilder from './search-builder';
@@ -231,8 +230,6 @@ class QueryOptions {
     const primaryKey = _.values(this._model.primaryKeys)[0].field;
     const queryToFilterRecords = query.trim();
 
-    new LiveQueryChecker().perform(queryToFilterRecords);
-
     try {
       const options = { type: this._Sequelize.QueryTypes.SELECT };
       const records = await this._model.sequelize.query(queryToFilterRecords, options);

src/services/query-options.js

@@ -1,20 +1,19 @@
-const LiveQueryChecker = require('./live-query-checker');
 
 function QueryStatGetter(params, opts) {
-  const QUERY_OPTIONS_SELECT = { type: opts.Sequelize.QueryTypes.SELECT };
-
   this.perform = function perform() {
     let rawQuery = params.query.trim();
+    const bind = params.contextVariables || {};
 
-    new LiveQueryChecker().perform(rawQuery);
-
-    if (params.record_id) {
-      rawQuery = rawQuery.replace(new RegExp('\\?', 'g'), params.record_id);
+    if (bind.recordId && !rawQuery.includes('$recordId')) {
+      rawQuery = rawQuery.replace(/\?/g, '$recordId');
     }
 
     // WARNING: Choosing the first connection might generate issues if the model
     //          does not belongs to this database.
-    return Object.values(opts.connections)[0].query(rawQuery, QUERY_OPTIONS_SELECT);
+    return Object.values(opts.connections)[0].query(rawQuery, {
+      type: opts.Sequelize.QueryTypes.SELECT,
+      bind,
+    });
   };
 }
 

src/services/query-stat-getter.js

@@ -22,25 +22,25 @@ class ValueStatGetter {
 
   /** Function used to aggregate results (count, sum, ...) */
   get _aggregateFunction() {
-    return this._params.aggregate.toLowerCase();
+    return this._params.aggregator.toLowerCase();
   }
 
   /** Column name we're aggregating on */
   get _aggregateField() {
     // NOTICE: As MySQL cannot support COUNT(table_name.*) syntax, fieldName cannot be '*'.
-    const fieldName = this._params.aggregate_field
+    const fieldName = this._params.aggregateFieldName
       || this._schema.primaryKeys[0]
       || this._schema.fields[0].field;
 
     return `${this._schema.name}.${Orm.getColumnName(this._schema, fieldName)}`;
   }
 
   async perform() {
-    const { filters, timezone } = this._params;
+    const { filter, timezone } = this._params;
     const scopeFilters = await scopeManager.getScopeForUser(this._user, this._model.name, true);
 
     const queryOptions = new QueryOptions(this._model, { includeRelations: true });
-    await queryOptions.filterByConditionTree(filters, timezone);
+    await queryOptions.filterByConditionTree(filter, timezone);
     await queryOptions.filterByConditionTree(scopeFilters, timezone);
 
     // No attributes should be retrieved from relations for the group by to work.
@@ -74,13 +74,13 @@ class ValueStatGetter {
    * - when scopes use the same field as the filter
    */
   async _getCountPrevious(options) {
-    const { filters, timezone } = this._params;
-    if (!filters) {
+    const { filter, timezone } = this._params;
+    if (!filter) {
       return undefined;
     }
 
     const conditionsParser = new FiltersParser(this._schema, timezone, this._options);
-    const rawInterval = conditionsParser.getPreviousIntervalCondition(filters);
+    const rawInterval = conditionsParser.getPreviousIntervalCondition(filter);
     if (!rawInterval) {
       return undefined;
     }