Compare commits
34
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 CI
|
8a79265ad5 | ||
 james.maes
|
f18296968f
|
||
|
james.maesandClaude Opus 5.5
|
6b9b1b6839
|
||
|
CI
|
0d696e5e58 | ||
|
james.maes
|
0447f6ebad
|
||
|
james.maesandClaude Sonnet 5.5
|
a389bfb8b0
|
||
|
james.maesandClaude Sonnet 5.5
|
0d876645b9
|
||
|
james.maes
|
d676d4deae
|
||
|
james.maesandClaude Opus 5.5
|
eada066948
|
||
|
james.maes
|
f3b949ff39
|
||
|
CI
|
f2d60fc4d4 | ||
|
james.maesandClaude Opus 5.5
|
2c225df4c9
|
||
 forge-recovery
|
9ba3336fe9
|
||
|
|
afeae2c491
|
||
|
|
9ffbd57472
|
||
|
forge-recoveryandCodex
|
34aa211bf9
|
||
|
james.maes
|
3a62d995cf | ||
|
james.maes
|
7c23d9e43c | ||
|
james.maesandCodex
|
9e0c91eda6
|
||
|
james.maesandCodex
|
1cc5928ba7
|
||
|
james.maesandCodex
|
b2c4e02856 | ||
|
james.maesandCodex
|
d1b58efdaa | ||
|
james.maesandCodex
|
11c87dfb7e | ||
|
james.maes
|
5969a17b01 | ||
|
james.maesandCodex
|
5dd9b4b241
|
||
|
james.maes
|
af8618ec0f | ||
|
james.maesandClaude Opus 5.5
|
e708c61a1d
|
||
|
james.maesandClaude Opus 5.5
|
97b764640f
|
||
|
james.maes
|
5716121c14 | ||
|
james.maesandClaude Opus 5.5
|
a799258a9e | ||
|
James MaesandClaude Opus 4.8
|
e22e8d96cd | ||
|
james.maesandClaude Opus 4.7
|
f2df9b63f6 | ||
|
james.maesandClaude Opus 4.7
|
964567d92f | ||
|
Tim Chamberlain
|
1cb5da40a8 |
No files matched your search
+10
-52
@@ -1,56 +1,14 @@
|
||||
version: 2.1
|
||||
|
||||
setup: true
|
||||
orbs:
|
||||
qqq-orb: kingsrook/qqq-orb@0.6
|
||||
|
||||
qqq-orb: kingsrook/qqq-orb@0.8
|
||||
workflows:
|
||||
test_only:
|
||||
setup:
|
||||
jobs:
|
||||
- qqq-orb/mvn_test_only:
|
||||
context: [qqq-maven-registry-credentials]
|
||||
filters:
|
||||
branches:
|
||||
ignore: /(develop|main|release/.*|hotfix/.*|integration.*)/
|
||||
tags:
|
||||
only: []
|
||||
|
||||
publish_snapshot:
|
||||
jobs:
|
||||
- qqq-orb/mvn_publish:
|
||||
context: [qqq-maven-registry-credentials]
|
||||
branch_type: snapshot
|
||||
filters:
|
||||
branches:
|
||||
only:
|
||||
- develop
|
||||
|
||||
publish_release_candidate:
|
||||
jobs:
|
||||
- qqq-orb/mvn_publish:
|
||||
context: [qqq-maven-registry-credentials]
|
||||
branch_type: release_candidate
|
||||
filters:
|
||||
branches:
|
||||
only:
|
||||
- /release\/.*/
|
||||
|
||||
publish_release:
|
||||
jobs:
|
||||
- qqq-orb/mvn_publish:
|
||||
context: [qqq-maven-registry-credentials]
|
||||
branch_type: release
|
||||
filters:
|
||||
branches:
|
||||
ignore: /.*/
|
||||
tags:
|
||||
only: [/v.*/]
|
||||
|
||||
publish_hotfix_release:
|
||||
jobs:
|
||||
- qqq-orb/mvn_publish:
|
||||
context: [qqq-maven-registry-credentials]
|
||||
branch_type: hotfix
|
||||
filters:
|
||||
branches:
|
||||
only:
|
||||
- /hotfix\/.*/
|
||||
- qqq-orb/generate_pipeline:
|
||||
orb_version: '0.8'
|
||||
filters:
|
||||
branches:
|
||||
ignore: automation/qbit-rc-pending
|
||||
tags:
|
||||
only: /^v\d+\.\d+\.\d+$/
|
||||
@@ -0,0 +1,7 @@
|
||||
name: build
|
||||
on:
|
||||
push:
|
||||
jobs:
|
||||
maven:
|
||||
uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/maven.yaml@v1
|
||||
secrets: inherit
|
||||
@@ -0,0 +1 @@
|
||||
* @KofTwentyTwo
|
||||
@@ -0,0 +1,23 @@
|
||||
name: CodeQL
|
||||
'on':
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
- develop
|
||||
- release/**
|
||||
- hotfix/**
|
||||
pull_request: {}
|
||||
schedule:
|
||||
- cron: 41 16 * * 0
|
||||
workflow_dispatch: {}
|
||||
permissions:
|
||||
contents: read
|
||||
actions: read
|
||||
security-events: write
|
||||
packages: read
|
||||
concurrency:
|
||||
group: codeql-${{ github.event.pull_request.number || github.ref }}
|
||||
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
||||
jobs:
|
||||
analyze:
|
||||
uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
profile: qbit
|
||||
orb_version: '0.8'
|
||||
default_branch: main
|
||||
java_version: '21'
|
||||
browsers: true
|
||||
api_checks: false
|
||||
docs_only: false
|
||||
release_on_main: false
|
||||
release_tag_policy: stable
|
||||
test_branch_policy: feature-no-hotfix
|
||||
publish:
|
||||
snapshot: true
|
||||
release_candidate: true
|
||||
release: true
|
||||
hotfix: true
|
||||
asciidoc: false
|
||||
release_completion: false
|
||||
@@ -0,0 +1,17 @@
|
||||
# qbit-custom-apps
|
||||
|
||||
## Knowledge base
|
||||
|
||||
Reviewed knowledge for this repo and the wider QQQ platform lives in the second-brain
|
||||
vault (`$SECOND_BRAIN_VAULT`):
|
||||
|
||||
- Hub / entry point: `knowledge/qqq/qqq-hub.md`
|
||||
- This repo's dossier: `knowledge/qqq/repos/qbit-custom-apps.md`
|
||||
(reviewed at commit `f2df9b63f6cb`, branch `main`, 2026-07-04)
|
||||
- QBit mechanics refresher: `knowledge/qqq/architecture/metadata-model.md`
|
||||
|
||||
Key facts from the review: experimental/demo-stage QBit; real development is on
|
||||
`origin/develop` (never merged to main); main pins qqq-backend-core and
|
||||
qqq-frontend-material-dashboard to the local-dev sentinel `0.9999.0` (not buildable from
|
||||
public repos); licensing is contradictory (Apache-2.0 LICENSE vs AGPL pom/headers, plus a
|
||||
proprietary ColdTrack header on `LookerWidgetRenderer.java`); no tests, no releases.
|
||||
@@ -0,0 +1,202 @@
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to the Licensor for inclusion in the Work by the copyright
|
||||
owner or by an individual or Legal Entity authorized to submit on
|
||||
behalf of the copyright owner. For the purposes of this definition,
|
||||
"submitted" means any form of electronic, verbal, or written
|
||||
communication sent to the Licensor or its representatives, including
|
||||
but not limited to communication on electronic mailing lists, source
|
||||
code control systems, and issue tracking systems that are managed by,
|
||||
or on behalf of, the Licensor for the purpose of discussing and
|
||||
improving the Work, but excluding communication that is conspicuously
|
||||
marked or otherwise designated in writing by the copyright owner as
|
||||
"Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright 2022-2025 QRunIO, LLC
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
@@ -0,0 +1,46 @@
|
||||
# qbit-custom-apps
|
||||
|
||||
[](https://opensource.org/licenses/Apache-2.0)
|
||||
|
||||
> **Status:** 0.1 release line, built on QQQ 4.1 (`4.1.0-RC.22`) and `qbit-user-role-permissions` `0.33.0-RC.1`. Published to the QRun-IO Gitea Maven registry only (`https://git.kof22.com/api/packages/QRun-IO/maven`); release candidates are `0.1.0-RC.N`.
|
||||
|
||||
QBit that aims to let qqq apps register **custom application screens** declaratively — pages built from widgets, forms, and table views — without writing dedicated front-end components.
|
||||
|
||||
**Type:** Application QBit
|
||||
**For:** Developers building qqq apps that need bespoke screens beyond standard table CRUD
|
||||
|
||||
## Why this exists
|
||||
|
||||
qqq's standard dashboard renders auto-generated screens from table metadata. Most apps eventually need pages that *don't* map to a single table — operator dashboards, configurator wizards, multi-step workflows that pull data from several sources, embedded Looker dashboards, etc. `qbit-custom-apps` is intended to let those screens be declared as metadata.
|
||||
|
||||
## What it provides
|
||||
|
||||
The repository contains the following package layout:
|
||||
|
||||
```
|
||||
src/main/java/com/kingsrook/qbits/customapps/
|
||||
├── definition/ # CustomAppDefinition and related metadata
|
||||
├── model/ # Data models backing custom apps
|
||||
├── metadata/ # Metadata producers and registrators
|
||||
└── widgets/ # Widget composition utilities
|
||||
```
|
||||
|
||||
## How it relates to other qqq repos
|
||||
|
||||
- **Declared dependencies:** `qqq-backend-core`, `qqq-middleware-api` (optional), `qqq-middleware-javalin`, `qbit-user-role-permissions`; test scope: `qqq-backend-module-rdbms`, `qqq-backend-module-postgres`. All versions come from the `qqq-bom-pom` import (`4.1.0-RC.22`).
|
||||
- **Inherits from:** `qbit-build-parent` (in the `qbit-bom` repo).
|
||||
- **Frontend pair:** Custom apps render via the standard qqq dashboard; no separate frontend component needed.
|
||||
|
||||
## Known gaps
|
||||
|
||||
- Integration tests (`CustomAppsPostgresTest`) use a PostgreSQL Testcontainer, so building needs Docker.
|
||||
- Pre-1.0: the metadata and permission model may still change between release candidates.
|
||||
- Depends on QQQ 4.1 release candidates, so it is not yet pinned to a final QQQ 4.1.0.
|
||||
|
||||
## License
|
||||
|
||||
Apache License 2.0 — see [LICENSE](./LICENSE).
|
||||
|
||||
## Contributing
|
||||
|
||||
See [CONTRIBUTING.md](./CONTRIBUTING.md), [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md), [CODE_STYLE.md](./CODE_STYLE.md), and [SECURITY.md](./SECURITY.md).
|
||||
@@ -23,17 +23,21 @@
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||||
|
||||
<properties>
|
||||
<revision>0.1.0-SNAPSHOT</revision>
|
||||
<revision>0.3.0-SNAPSHOT</revision>
|
||||
<maven.compiler.source>21</maven.compiler.source>
|
||||
<maven.compiler.target>21</maven.compiler.target>
|
||||
<maven.compiler.showDeprecation>true</maven.compiler.showDeprecation>
|
||||
<maven.compiler.showWarnings>true</maven.compiler.showWarnings>
|
||||
<!-- jacoco sets argLine; the empty default keeps the UTC surefire argLine below valid when jacoco is not active -->
|
||||
<argLine></argLine>
|
||||
<!-- qbit-user-role-permissions built for the QQQ 4.1 family: 0.33.0-RC.1, latest in the QRun-IO Gitea Maven registry. -->
|
||||
<urp.version>0.33.0-RC.2</urp.version>
|
||||
</properties>
|
||||
|
||||
<parent>
|
||||
<groupId>com.kingsrook</groupId>
|
||||
<artifactId>qbit-build-parent</artifactId>
|
||||
<version>1.4.0</version>
|
||||
<version>2.2.1</version>
|
||||
</parent>
|
||||
|
||||
<groupId>com.kingsrook.qbits</groupId>
|
||||
@@ -56,6 +60,16 @@
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<!-- PostgreSQL instants (CustomAppsPostgresTest) are only correct under a UTC JVM -->
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-surefire-plugin</artifactId>
|
||||
<configuration>
|
||||
<argLine>@{argLine} -Duser.timezone=UTC</argLine>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
<resources>
|
||||
<resource>
|
||||
<directory>src/main/resources</directory>
|
||||
@@ -82,16 +96,35 @@
|
||||
</scm>
|
||||
|
||||
|
||||
<dependencyManagement>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>com.kingsrook.qqq</groupId>
|
||||
<artifactId>qqq-bom-pom</artifactId>
|
||||
<!-- The LOCAL_WIDGET backend, per-session metadata customizer and restricted-permission code need the QQQ 4.1 family: the published core
|
||||
(QRun-IO Gitea Maven registry), the one BOM version shared by the four app-QBit patches. -->
|
||||
<version>4.1.0-RC.25</version>
|
||||
<type>pom</type>
|
||||
<scope>import</scope>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
</dependencyManagement>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>com.kingsrook.qqq</groupId>
|
||||
<artifactId>qqq-backend-core</artifactId>
|
||||
<version>0.40.0-custom-apps-qbit-a8315bc5-20260206.224214-1</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.kingsrook.qbits</groupId>
|
||||
<artifactId>qbit-user-role-permissions</artifactId>
|
||||
<version>0.31.0</version>
|
||||
<version>${urp.version}</version>
|
||||
<exclusions>
|
||||
<exclusion>
|
||||
<groupId>com.kingsrook.qqq</groupId>
|
||||
<artifactId>qqq-backend-core</artifactId>
|
||||
</exclusion>
|
||||
</exclusions>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.kingsrook.qqq</groupId>
|
||||
@@ -103,11 +136,6 @@
|
||||
<artifactId>qqq-backend-module-rdbms</artifactId>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.kingsrook.qqq</groupId>
|
||||
<artifactId>qqq-frontend-material-dashboard</artifactId>
|
||||
<version>0.40.0-custom-apps-qbit-f0df995-20260206.202533-1</version>
|
||||
</dependency>
|
||||
|
||||
<dependency>
|
||||
<groupId>org.junit.jupiter</groupId>
|
||||
@@ -117,7 +145,24 @@
|
||||
<dependency>
|
||||
<groupId>org.assertj</groupId>
|
||||
<artifactId>assertj-core</artifactId>
|
||||
<version>3.27.3</version>
|
||||
<version>3.27.7</version>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.kingsrook.qqq</groupId>
|
||||
<artifactId>qqq-backend-module-postgres</artifactId>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.h2database</groupId>
|
||||
<artifactId>h2</artifactId>
|
||||
<version>2.2.220</version>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.testcontainers</groupId>
|
||||
<artifactId>testcontainers</artifactId>
|
||||
<version>2.0.3</version>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
|
||||
@@ -44,6 +44,10 @@ public class CustomAppsQBitConfig implements QBitConfig
|
||||
private boolean includeApiVersions = false;
|
||||
private String componentSourceUrl;
|
||||
|
||||
private String backendName;
|
||||
|
||||
private java.util.Set<String> allowedComponentHosts = new java.util.LinkedHashSet<>();
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
@@ -63,6 +67,7 @@ public class CustomAppsQBitConfig implements QBitConfig
|
||||
@Override
|
||||
public void validate(QInstance qInstance, List<String> errors)
|
||||
{
|
||||
assertCondition(backendName != null && !backendName.isBlank(), "backendName is required for the Custom Apps QBit", errors);
|
||||
if(includeApiVersions && !apiMiddlewareModuleAvailable)
|
||||
{
|
||||
errors.add("Custom Apps QBit is configured to includeApiVersions, but the qqq-middleware-api module is available.");
|
||||
@@ -173,4 +178,59 @@ public class CustomAppsQBitConfig implements QBitConfig
|
||||
return (this);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** The backend the qbit's tables live on.
|
||||
*******************************************************************************/
|
||||
@Override
|
||||
public String getDefaultBackendNameForTables()
|
||||
{
|
||||
return (backendName);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Getter for backendName
|
||||
*******************************************************************************/
|
||||
public String getBackendName()
|
||||
{
|
||||
return (this.backendName);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Fluent setter for backendName
|
||||
*******************************************************************************/
|
||||
public CustomAppsQBitConfig withBackendName(String backendName)
|
||||
{
|
||||
this.backendName = backendName;
|
||||
return (this);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Getter for allowedComponentHosts (lower-case host names an https component
|
||||
** bundle may be loaded from; empty means paths on this application only)
|
||||
*******************************************************************************/
|
||||
public java.util.Set<String> getAllowedComponentHosts()
|
||||
{
|
||||
return (this.allowedComponentHosts);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Fluent setter for allowedComponentHosts
|
||||
*******************************************************************************/
|
||||
public CustomAppsQBitConfig withAllowedComponentHosts(java.util.Collection<String> hosts)
|
||||
{
|
||||
this.allowedComponentHosts = new java.util.LinkedHashSet<>();
|
||||
hosts.forEach(host -> this.allowedComponentHosts.add(host.toLowerCase()));
|
||||
return (this);
|
||||
}
|
||||
|
||||
}
|
||||
+68
@@ -0,0 +1,68 @@
|
||||
/*
|
||||
* QQQ - Low-code Application Framework for Engineers.
|
||||
* Copyright (C) 2021-2025. Kingsrook, LLC
|
||||
* 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
|
||||
* contact@kingsrook.com
|
||||
* https://github.com/Kingsrook/
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License as
|
||||
* published by the Free Software Foundation, either version 3 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License
|
||||
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package com.kingsrook.qbits.customapps.metadata;
|
||||
|
||||
|
||||
import com.kingsrook.qbits.customapps.model.CustomAppContainer;
|
||||
import com.kingsrook.qqq.backend.core.actions.dashboard.widgets.ChildRecordListRenderer;
|
||||
import com.kingsrook.qqq.backend.core.exceptions.QException;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducer;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.dashboard.QWidgetMetaData;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinOn;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinType;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.joins.QJoinMetaData;
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** The "users" section of a custom app container: the roles that hold the container's access
|
||||
** permission (rows of the permission-to-role table), as a child record list.
|
||||
*******************************************************************************/
|
||||
public class CustomAppContainerPermissionsWidgetMetaDataProducer extends MetaDataProducer<QWidgetMetaData>
|
||||
{
|
||||
public static final String NAME = "customAppContainerPermissions";
|
||||
public static final String JOIN_NAME = "customAppContainerRolePermission";
|
||||
|
||||
|
||||
|
||||
/***************************************************************************
|
||||
** The widget, and (as a side effect, once) its join.
|
||||
***************************************************************************/
|
||||
@Override
|
||||
public QWidgetMetaData produce(QInstance qInstance) throws QException
|
||||
{
|
||||
if(qInstance.getJoin(JOIN_NAME) == null)
|
||||
{
|
||||
qInstance.addJoin(new QJoinMetaData()
|
||||
.withName(JOIN_NAME)
|
||||
.withLeftTable(CustomAppContainer.TABLE_NAME)
|
||||
.withRightTable("rolePermissionInt")
|
||||
.withType(JoinType.ONE_TO_MANY)
|
||||
.withJoinOn(new JoinOn("permissionId", "permissionId")));
|
||||
}
|
||||
QWidgetMetaData widget = ChildRecordListRenderer.widgetMetaDataBuilder(qInstance.getJoin(JOIN_NAME))
|
||||
.withLabel("Roles with access")
|
||||
.getWidgetMetaData();
|
||||
widget.setName(NAME);
|
||||
return (widget);
|
||||
}
|
||||
}
|
||||
+68
@@ -0,0 +1,68 @@
|
||||
/*
|
||||
* QQQ - Low-code Application Framework for Engineers.
|
||||
* Copyright (C) 2021-2025. Kingsrook, LLC
|
||||
* 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
|
||||
* contact@kingsrook.com
|
||||
* https://github.com/Kingsrook/
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License as
|
||||
* published by the Free Software Foundation, either version 3 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License
|
||||
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package com.kingsrook.qbits.customapps.metadata;
|
||||
|
||||
|
||||
import com.kingsrook.qbits.customapps.model.CustomApp;
|
||||
import com.kingsrook.qqq.backend.core.actions.dashboard.widgets.ChildRecordListRenderer;
|
||||
import com.kingsrook.qqq.backend.core.exceptions.QException;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducer;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.dashboard.QWidgetMetaData;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinOn;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinType;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.joins.QJoinMetaData;
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** The "users" section of a custom app: the roles that hold the app's access
|
||||
** permission (rows of the permission-to-role table), as a child record list.
|
||||
*******************************************************************************/
|
||||
public class CustomAppPermissionsWidgetMetaDataProducer extends MetaDataProducer<QWidgetMetaData>
|
||||
{
|
||||
public static final String NAME = "customAppPermissions";
|
||||
public static final String JOIN_NAME = "customAppRolePermission";
|
||||
|
||||
|
||||
|
||||
/***************************************************************************
|
||||
** The widget, and (as a side effect, once) its join.
|
||||
***************************************************************************/
|
||||
@Override
|
||||
public QWidgetMetaData produce(QInstance qInstance) throws QException
|
||||
{
|
||||
if(qInstance.getJoin(JOIN_NAME) == null)
|
||||
{
|
||||
qInstance.addJoin(new QJoinMetaData()
|
||||
.withName(JOIN_NAME)
|
||||
.withLeftTable(CustomApp.TABLE_NAME)
|
||||
.withRightTable("rolePermissionInt")
|
||||
.withType(JoinType.ONE_TO_MANY)
|
||||
.withJoinOn(new JoinOn("permissionId", "permissionId")));
|
||||
}
|
||||
QWidgetMetaData widget = ChildRecordListRenderer.widgetMetaDataBuilder(qInstance.getJoin(JOIN_NAME))
|
||||
.withLabel("Roles with access")
|
||||
.getWidgetMetaData();
|
||||
widget.setName(NAME);
|
||||
return (widget);
|
||||
}
|
||||
}
|
||||
+142
-4
@@ -28,6 +28,7 @@ import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.function.Function;
|
||||
import java.util.stream.Collectors;
|
||||
import com.kingsrook.qbits.customapps.CustomAppsQBitConfig;
|
||||
import com.kingsrook.qbits.customapps.model.CustomApp;
|
||||
import com.kingsrook.qbits.customapps.model.CustomAppBackendConfig;
|
||||
import com.kingsrook.qbits.customapps.model.CustomAppBackendEnum;
|
||||
@@ -38,6 +39,8 @@ import com.kingsrook.qbits.customapps.utils.CustomAppsUtils;
|
||||
import com.kingsrook.qbits.customapps.widgets.LookerWidgetRenderer;
|
||||
import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
|
||||
import com.kingsrook.qqq.backend.core.context.QContext;
|
||||
import com.kingsrook.qqq.backend.core.model.session.QSession;
|
||||
import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
|
||||
import com.kingsrook.qqq.backend.core.exceptions.QException;
|
||||
import com.kingsrook.qqq.backend.core.instances.QMetaDataVariableInterpreter;
|
||||
import com.kingsrook.qqq.backend.core.logging.QLogger;
|
||||
@@ -76,6 +79,42 @@ public class CustomAppsDynamicMetaDataProducer
|
||||
*
|
||||
***************************************************************************/
|
||||
public CustomAppData getCustomAppList(QInstance qInstance) throws QException
|
||||
{
|
||||
////////////////////////////////////////////////////////////////////////////////
|
||||
// capture the viewer now: the build itself runs with the system session set //
|
||||
////////////////////////////////////////////////////////////////////////////////
|
||||
QSession viewer = QContext.getQSession();
|
||||
return (getCustomAppList(qInstance, name -> viewer != null && viewer.hasPermission(name + ".hasAccess")));
|
||||
}
|
||||
|
||||
|
||||
|
||||
/***************************************************************************
|
||||
** Build the apps for whoever the predicate admits (by app/container name).
|
||||
** The definition rows are read as the system user (they are configuration,
|
||||
** not data of the viewer); what the viewer may see is decided only by the
|
||||
** predicate, which the metadata customizer ties to the session's permissions.
|
||||
***************************************************************************/
|
||||
public CustomAppData getCustomAppList(QInstance qInstance, java.util.function.Predicate<String> permitted) throws QException
|
||||
{
|
||||
QSession original = QContext.getQSession();
|
||||
try
|
||||
{
|
||||
QContext.setQSession(new QSystemUserSession());
|
||||
return (buildCustomAppList(qInstance, permitted, original));
|
||||
}
|
||||
finally
|
||||
{
|
||||
QContext.setQSession(original);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
/***************************************************************************
|
||||
** The build proper, with the system session in place for reads.
|
||||
***************************************************************************/
|
||||
private CustomAppData buildCustomAppList(QInstance qInstance, java.util.function.Predicate<String> permitted, QSession viewer) throws QException
|
||||
{
|
||||
///////////////////////////////////////////////////
|
||||
// look up data needed to set up the custom apps //
|
||||
@@ -152,7 +191,7 @@ public class CustomAppsDynamicMetaDataProducer
|
||||
/////////////////////////////////////////////////////
|
||||
// make sure user has permission to this app //
|
||||
////////////////////////////////////////////////////
|
||||
if(!QContext.getQSession().hasPermission(appName + ".hasAccess"))
|
||||
if(!permitted.test(appName))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
@@ -161,8 +200,21 @@ public class CustomAppsDynamicMetaDataProducer
|
||||
// create a custom widget for this app //
|
||||
/////////////////////////////////////////
|
||||
String widgetName = appName + "Widget";
|
||||
QWidgetMetaDataInterface widget = buildWidget(qInstance, app, customAppBackendConfigMap, widgetName);
|
||||
CustomAppIcon appIcon = customAppIconMap.get(app.getCustomAppIconId());
|
||||
QWidgetMetaDataInterface widget;
|
||||
try
|
||||
{
|
||||
widget = buildWidget(qInstance, app, customAppBackendConfigMap, widgetName);
|
||||
}
|
||||
catch(IllegalArgumentException e)
|
||||
{
|
||||
///////////////////////////////////////////////////////////////////////
|
||||
// one invalid row must not take the other apps (or startup) with it; //
|
||||
// it is simply not offered //
|
||||
///////////////////////////////////////////////////////////////////////
|
||||
LOG.warn("Custom app skipped: its definition is not valid", logPair("app", app.getName()), logPair("reason", e.getMessage()));
|
||||
continue;
|
||||
}
|
||||
CustomAppIcon appIcon = customAppIconMap.get(app.getCustomAppIconId());
|
||||
|
||||
QAppMetaData appMetaData = new QAppMetaData()
|
||||
.withPermissionRules(qInstance.getDefaultPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION).withPermissionBaseName(appName).withDenyBehavior(DenyBehavior.HIDDEN))
|
||||
@@ -217,7 +269,7 @@ public class CustomAppsDynamicMetaDataProducer
|
||||
/////////////////////////////////////////////////////
|
||||
// make sure user has permission to this container //
|
||||
/////////////////////////////////////////////////////
|
||||
if(!QContext.getQSession().hasPermission(containerName + ".hasAccess"))
|
||||
if(!permitted.test(containerName))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
@@ -248,6 +300,8 @@ public class CustomAppsDynamicMetaDataProducer
|
||||
{
|
||||
case LOOKER:
|
||||
return (buildLookerWidget(qInstance, customApp, widgetName));
|
||||
case LOCAL_WIDGET:
|
||||
return (localWidget(qInstance, customApp));
|
||||
default:
|
||||
throw new IllegalArgumentException("Unknown custom app backend: " + customAppBackendConfig.getCustomAppBackendId());
|
||||
}
|
||||
@@ -256,6 +310,34 @@ public class CustomAppsDynamicMetaDataProducer
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** a custom app that shows a widget the application itself defines (a record
|
||||
** list, a chart, ...): the screen is composed from existing, permissioned
|
||||
** metadata, so no code or markup comes from the data, and the widget keeps its
|
||||
** own permission rules. Only widgets that exist on the instance can be named,
|
||||
** and never this qbit's own generated ones.
|
||||
*******************************************************************************/
|
||||
private QWidgetMetaDataInterface localWidget(QInstance qInstance, CustomApp customApp)
|
||||
{
|
||||
String name = customApp.getWidgetName();
|
||||
if(!StringUtils.hasContent(name))
|
||||
{
|
||||
throw new IllegalArgumentException("a local widget app needs a widget name");
|
||||
}
|
||||
QWidgetMetaDataInterface widget = qInstance.getWidget(name);
|
||||
if(widget == null)
|
||||
{
|
||||
throw new IllegalArgumentException("widget " + name + " is not defined on this application");
|
||||
}
|
||||
if(name.startsWith("qca"))
|
||||
{
|
||||
throw new IllegalArgumentException("widget " + name + " is generated by custom apps and cannot be chosen");
|
||||
}
|
||||
return (widget);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** builds a widget to be used for a customapps app
|
||||
*******************************************************************************/
|
||||
@@ -271,10 +353,19 @@ public class CustomAppsDynamicMetaDataProducer
|
||||
componentSourceUrl = "/dynamic-qfmd-components/q-embed-looker-dashboards.bundle.js";
|
||||
}
|
||||
|
||||
if(!isAllowedComponentSource(componentSourceUrl))
|
||||
{
|
||||
throw new IllegalArgumentException("the component source must be a path on this application (or an https address the configuration allows)");
|
||||
}
|
||||
|
||||
//////////////////////////////
|
||||
// add the dashboard to url //
|
||||
/////////////////////////
|
||||
Integer dashboardId = customApp.getLookerDashboardId();
|
||||
if(dashboardId == null)
|
||||
{
|
||||
throw new IllegalArgumentException("a Looker app needs a dashboard id");
|
||||
}
|
||||
componentSourceUrl += "?dashboardId=" + dashboardId;
|
||||
|
||||
Map<String, Serializable> defaultValues = MapBuilder.of(
|
||||
@@ -287,6 +378,7 @@ public class CustomAppsDynamicMetaDataProducer
|
||||
|
||||
QWidgetMetaData lookerWidget = new QWidgetMetaData()
|
||||
.withName(widgetName)
|
||||
.withPermissionRules(qInstance.getDefaultPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION).withPermissionBaseName(customApp.getName() == null ? widgetName : CustomAppsUtils.getCamelCaseName(customApp.getName(), CustomApp.TABLE_NAME)).withDenyBehavior(DenyBehavior.HIDDEN))
|
||||
.withType(WidgetType.CUSTOM_COMPONENT.getType())
|
||||
.withCodeReference(new QCodeReference(LookerWidgetRenderer.class))
|
||||
.withGridColumns(12)
|
||||
@@ -303,5 +395,51 @@ public class CustomAppsDynamicMetaDataProducer
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** The component bundle is code the browser runs, so its source is never taken
|
||||
** from data: a path served by this application, or an https address whose host
|
||||
** the configuration lists. Anything else (script or data URLs, protocol
|
||||
** relative addresses, other hosts) is refused.
|
||||
*******************************************************************************/
|
||||
public boolean isAllowedComponentSource(String url)
|
||||
{
|
||||
if(url == null || url.chars().anyMatch(c -> c < 0x21 || c > 0x7e))
|
||||
{
|
||||
return (false);
|
||||
}
|
||||
if(url.startsWith("/") && !url.startsWith("//") && !url.contains("\\") && !url.contains(".."))
|
||||
{
|
||||
return (true);
|
||||
}
|
||||
try
|
||||
{
|
||||
java.net.URI uri = new java.net.URI(url);
|
||||
CustomAppsQBitConfig config = configFor(QContext.getQInstance());
|
||||
return ("https".equals(uri.getScheme()) && uri.getUserInfo() == null && uri.getHost() != null
|
||||
&& config != null && config.getAllowedComponentHosts().contains(uri.getHost().toLowerCase()));
|
||||
}
|
||||
catch(java.net.URISyntaxException e)
|
||||
{
|
||||
return (false);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** The qbit's configuration on the instance, if installed.
|
||||
*******************************************************************************/
|
||||
static CustomAppsQBitConfig configFor(QInstance qInstance)
|
||||
{
|
||||
if(qInstance == null || qInstance.getQBits() == null)
|
||||
{
|
||||
return (null);
|
||||
}
|
||||
return (qInstance.getQBits().values().stream().map(qBit -> qBit.getConfig()).filter(CustomAppsQBitConfig.class::isInstance)
|
||||
.map(CustomAppsQBitConfig.class::cast).findFirst().orElse(null));
|
||||
}
|
||||
|
||||
|
||||
|
||||
public record CustomAppData(List<QAppMetaData> containerList, Map<String, String> positionMap, Map<String, QAppMetaData> appMap, Map<String, QWidgetMetaDataInterface> widgetMap) {}
|
||||
}
|
||||
+117
@@ -0,0 +1,117 @@
|
||||
/*
|
||||
* QQQ - Low-code Application Framework for Engineers.
|
||||
* Copyright (C) 2021-2025. Kingsrook, LLC
|
||||
* 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
|
||||
* contact@kingsrook.com
|
||||
* https://github.com/Kingsrook/
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License as
|
||||
* published by the Free Software Foundation, either version 3 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License
|
||||
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package com.kingsrook.qbits.customapps.metadata;
|
||||
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import com.kingsrook.qqq.backend.core.actions.metadata.DefaultNoopMetaDataActionCustomizer;
|
||||
import com.kingsrook.qqq.backend.core.context.QContext;
|
||||
import com.kingsrook.qqq.backend.core.exceptions.QException;
|
||||
import com.kingsrook.qqq.backend.core.logging.QLogger;
|
||||
import com.kingsrook.qqq.backend.core.model.actions.metadata.MetaDataInput;
|
||||
import com.kingsrook.qqq.backend.core.model.actions.metadata.MetaDataOutput;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.dashboard.QWidgetMetaDataInterface;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.frontend.AppTreeNode;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.frontend.QFrontendAppMetaData;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.frontend.QFrontendWidgetMetaData;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData;
|
||||
import static com.kingsrook.qqq.backend.core.logging.LogUtils.logPair;
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Offers the declared custom apps to the frontend, per session: each request's
|
||||
** metadata gets exactly the containers, apps and widgets whose
|
||||
** "<name>.hasAccess" permission the session holds, ahead of a container named
|
||||
** by its "place before" setting. Everything else is the application's own
|
||||
** metadata customizer behaviour, left unchanged (this extends the standard no-op
|
||||
** customizer, so an application that needs its own rules extends this class).
|
||||
*******************************************************************************/
|
||||
public class CustomAppsMetaDataActionCustomizer extends DefaultNoopMetaDataActionCustomizer
|
||||
{
|
||||
private static final QLogger LOG = QLogger.getLogger(CustomAppsMetaDataActionCustomizer.class);
|
||||
|
||||
|
||||
|
||||
/***************************************************************************
|
||||
** Add the permitted custom apps to the finished metadata.
|
||||
***************************************************************************/
|
||||
@Override
|
||||
public void postProcess(MetaDataOutput metaDataOutput) throws QException
|
||||
{
|
||||
super.postProcess(metaDataOutput);
|
||||
|
||||
CustomAppsDynamicMetaDataProducer.CustomAppData data;
|
||||
try
|
||||
{
|
||||
data = new CustomAppsDynamicMetaDataProducer().getCustomAppList(QContext.getQInstance());
|
||||
}
|
||||
catch(QException | RuntimeException e)
|
||||
{
|
||||
LOG.warn("Custom apps could not be read; none are offered", logPair("error", e.getClass().getSimpleName()));
|
||||
return;
|
||||
}
|
||||
|
||||
MetaDataInput input = new MetaDataInput();
|
||||
for(QWidgetMetaDataInterface widget : data.widgetMap().values())
|
||||
{
|
||||
if(QContext.getQInstance().getWidget(widget.getName()) != null)
|
||||
{
|
||||
metaDataOutput.getWidgets().put(widget.getName(), new QFrontendWidgetMetaData(input, widget));
|
||||
}
|
||||
}
|
||||
for(QAppMetaData app : data.appMap().values())
|
||||
{
|
||||
metaDataOutput.getApps().put(app.getName(), new QFrontendAppMetaData(app, metaDataOutput));
|
||||
}
|
||||
|
||||
List<AppTreeNode> tree = new ArrayList<>(metaDataOutput.getAppTree());
|
||||
for(QAppMetaData container : data.containerList())
|
||||
{
|
||||
AppTreeNode node = new AppTreeNode(container);
|
||||
for(var section : container.getSections())
|
||||
{
|
||||
for(String appName : section.getApps())
|
||||
{
|
||||
QAppMetaData child = data.appMap().get(appName);
|
||||
if(child != null)
|
||||
{
|
||||
node.addChild(new AppTreeNode(child));
|
||||
}
|
||||
}
|
||||
}
|
||||
metaDataOutput.getApps().put(container.getName(), new QFrontendAppMetaData(container, metaDataOutput));
|
||||
int position = tree.size();
|
||||
String before = data.positionMap().get(container.getName());
|
||||
for(int i = 0; before != null && i < tree.size(); i++)
|
||||
{
|
||||
if(before.equals(tree.get(i).getName()))
|
||||
{
|
||||
position = i;
|
||||
break;
|
||||
}
|
||||
}
|
||||
tree.add(position, node);
|
||||
}
|
||||
metaDataOutput.setAppTree(tree);
|
||||
}
|
||||
}
|
||||
@@ -77,7 +77,7 @@ public class CustomApp extends QRecordEntity implements Serializable
|
||||
.withRecordLabelFormat("%s")
|
||||
.withRecordLabelFields("name")
|
||||
.withSection(SectionFactory.defaultT1("id"))
|
||||
.withSection(SectionFactory.defaultT2("name", "customAppIconId", "customAppBackendConfigId", "customAppSectionId", "sequenceNo", "lookerDashboardId", "permissionId"))
|
||||
.withSection(SectionFactory.defaultT2("name", "customAppIconId", "customAppBackendConfigId", "customAppSectionId", "sequenceNo", "lookerDashboardId", "widgetName", "permissionId"))
|
||||
.withSection(new QFieldSection("users", new QIcon().withName("person"), Tier.T2).withWidgetName("customAppPermissions"))
|
||||
.withSection(SectionFactory.defaultT3("createDate", "modifyDate"))
|
||||
|
||||
@@ -115,9 +115,12 @@ public class CustomApp extends QRecordEntity implements Serializable
|
||||
@QField(isEditable = false, possibleValueSourceName = Permission.TABLE_NAME)
|
||||
private Integer permissionId;
|
||||
|
||||
@QField(isRequired = true)
|
||||
@QField(label = "Looker Dashboard Id")
|
||||
private Integer lookerDashboardId;
|
||||
|
||||
@QField(label = "Local Widget", maxLength = 100, valueTooLongBehavior = ValueTooLongBehavior.ERROR)
|
||||
private String widgetName;
|
||||
|
||||
@QField(isEditable = false)
|
||||
private Instant createDate;
|
||||
|
||||
@@ -453,4 +456,35 @@ public class CustomApp extends QRecordEntity implements Serializable
|
||||
return (this);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Getter for widgetName
|
||||
*******************************************************************************/
|
||||
public String getWidgetName()
|
||||
{
|
||||
return (this.widgetName);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Setter for widgetName
|
||||
*******************************************************************************/
|
||||
public void setWidgetName(String widgetName)
|
||||
{
|
||||
this.widgetName = widgetName;
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Fluent setter for widgetName
|
||||
*******************************************************************************/
|
||||
public CustomApp withWidgetName(String widgetName)
|
||||
{
|
||||
this.widgetName = widgetName;
|
||||
return (this);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -33,7 +33,8 @@ import com.kingsrook.qqq.backend.core.model.metadata.producers.annotations.QMeta
|
||||
public enum CustomAppBackendEnum implements PossibleValueEnum<Integer>
|
||||
{
|
||||
LOOKER(1, "Looker"),
|
||||
URL(2, "URL");
|
||||
URL(2, "URL"),
|
||||
LOCAL_WIDGET(3, "Local widget");
|
||||
|
||||
private final Integer id;
|
||||
private final String label;
|
||||
|
||||
@@ -22,6 +22,7 @@
|
||||
package com.kingsrook.qbits.customapps.utils;
|
||||
|
||||
|
||||
import java.util.Map;
|
||||
import com.kingsrook.qbits.userrolepermissions.model.Permission;
|
||||
import com.kingsrook.qbits.userrolepermissions.model.PermissionObjectType;
|
||||
import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
|
||||
@@ -50,7 +51,7 @@ public class CustomAppPermissionUtils
|
||||
/////////////////////////////////////
|
||||
// if permission exists, return it //
|
||||
/////////////////////////////////////
|
||||
GetOutput output = new GetAction().execute(new GetInput(Permission.TABLE_NAME).withPrimaryKey(permissionName));
|
||||
GetOutput output = new GetAction().execute(new GetInput(Permission.TABLE_NAME).withUniqueKey(Map.of("name", permissionName)));
|
||||
if(output.getRecord() != null)
|
||||
{
|
||||
return (new Permission(output.getRecord()));
|
||||
|
||||
@@ -0,0 +1,395 @@
|
||||
/*
|
||||
* QQQ - Low-code Application Framework for Engineers.
|
||||
* Copyright (C) 2021-2025. Kingsrook, LLC
|
||||
* 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
|
||||
* contact@kingsrook.com
|
||||
* https://github.com/Kingsrook/
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License as
|
||||
* published by the Free Software Foundation, either version 3 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License
|
||||
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package com.kingsrook.qbits.customapps;
|
||||
|
||||
|
||||
import java.sql.Connection;
|
||||
import java.sql.DriverManager;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
import com.kingsrook.qbits.customapps.metadata.CustomAppsDynamicMetaDataProducer;
|
||||
import com.kingsrook.qbits.customapps.metadata.CustomAppsMetaDataActionCustomizer;
|
||||
import com.kingsrook.qbits.customapps.model.CustomApp;
|
||||
import com.kingsrook.qbits.customapps.model.CustomAppBackendEnum;
|
||||
import com.kingsrook.qbits.userrolepermissions.UserRolePermissionsQBitConfig;
|
||||
import com.kingsrook.qbits.userrolepermissions.UserRolePermissionsQBitProducer;
|
||||
import com.kingsrook.qqq.backend.core.actions.dashboard.RenderWidgetAction;
|
||||
import com.kingsrook.qqq.backend.core.actions.dashboard.widgets.AbstractWidgetRenderer;
|
||||
import com.kingsrook.qqq.backend.core.actions.metadata.MetaDataAction;
|
||||
import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
|
||||
import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
|
||||
import com.kingsrook.qqq.backend.core.context.QContext;
|
||||
import com.kingsrook.qqq.backend.core.exceptions.QException;
|
||||
import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
|
||||
import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
|
||||
import com.kingsrook.qqq.backend.core.model.actions.metadata.MetaDataInput;
|
||||
import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
|
||||
import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
|
||||
import com.kingsrook.qqq.backend.core.model.actions.widgets.RenderWidgetInput;
|
||||
import com.kingsrook.qqq.backend.core.model.actions.widgets.RenderWidgetOutput;
|
||||
import com.kingsrook.qqq.backend.core.model.dashboard.widgets.StatisticsData;
|
||||
import com.kingsrook.qqq.backend.core.model.dashboard.widgets.WidgetType;
|
||||
import com.kingsrook.qqq.backend.core.model.data.QRecord;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.dashboard.QWidgetMetaData;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.qbits.ProvidedOrSuppliedTableConfig;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
|
||||
import com.kingsrook.qqq.backend.core.model.session.QSession;
|
||||
import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
|
||||
import com.kingsrook.qqq.backend.module.postgres.model.metadata.PostgreSQLBackendMetaData;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
import org.junit.jupiter.api.AfterEach;
|
||||
import org.junit.jupiter.api.BeforeAll;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.testcontainers.containers.GenericContainer;
|
||||
import org.testcontainers.containers.wait.strategy.Wait;
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.assertj.core.api.Assertions.assertThatThrownBy;
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Custom apps on a real PostgreSQL 17: the schema owner creates the tables, the
|
||||
** application runs as a DML-only role, apps declared as rows reach the frontend
|
||||
** metadata per session, a custom screen shows a widget over local data, and the
|
||||
** apps' permissions (rows of the permission table the roles qbit manages) decide
|
||||
** who sees and renders it.
|
||||
*******************************************************************************/
|
||||
class CustomAppsPostgresTest
|
||||
{
|
||||
private static final String OWNER = "ca_owner";
|
||||
private static final String RUNTIME = "ca_runtime";
|
||||
private static final String BACKEND = "customAppsPg";
|
||||
private static final String ITEMS = "demoItem";
|
||||
private static final String WIDGET = "demoItemCountWidget";
|
||||
|
||||
private static GenericContainer<?> postgres;
|
||||
private static String host;
|
||||
private static int port;
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** PG17 with an owner-created schema (derived from the installed metadata) and a
|
||||
** DML-only runtime role.
|
||||
*******************************************************************************/
|
||||
@BeforeAll
|
||||
static void start() throws Exception
|
||||
{
|
||||
postgres = new GenericContainer<>("postgres:17-alpine")
|
||||
.withEnv("POSTGRES_PASSWORD", "super-synthetic")
|
||||
.withExposedPorts(5432)
|
||||
.waitingFor(Wait.forLogMessage(".*database system is ready to accept connections.*\\n", 2).withStartupTimeout(java.time.Duration.ofMinutes(2)));
|
||||
postgres.start();
|
||||
host = postgres.getHost();
|
||||
port = postgres.getMappedPort(5432);
|
||||
|
||||
try(Connection admin = connect("postgres", "super-synthetic", "postgres"); Statement statement = admin.createStatement())
|
||||
{
|
||||
statement.execute("CREATE ROLE " + OWNER + " LOGIN PASSWORD 'owner-synthetic'");
|
||||
statement.execute("CREATE ROLE " + RUNTIME + " LOGIN PASSWORD 'runtime-synthetic'");
|
||||
statement.execute("CREATE DATABASE customapps OWNER " + OWNER);
|
||||
statement.execute("REVOKE ALL ON DATABASE customapps FROM PUBLIC");
|
||||
statement.execute("GRANT CONNECT ON DATABASE customapps TO " + RUNTIME);
|
||||
}
|
||||
|
||||
QInstance scratch = instance(OWNER, "owner-synthetic");
|
||||
try(Connection owner = connect(OWNER, "owner-synthetic", "customapps"); Statement statement = owner.createStatement())
|
||||
{
|
||||
statement.execute("REVOKE ALL ON SCHEMA public FROM PUBLIC");
|
||||
statement.execute("GRANT USAGE ON SCHEMA public TO " + RUNTIME);
|
||||
for(QTableMetaData table : scratch.getTables().values())
|
||||
{
|
||||
if(BACKEND.equals(table.getBackendName()))
|
||||
{
|
||||
statement.execute(TestDdl.create(table));
|
||||
statement.execute("GRANT SELECT, INSERT, UPDATE, DELETE ON \"" + table.getName() + "\" TO " + RUNTIME);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Stop the database.
|
||||
*******************************************************************************/
|
||||
@AfterAll
|
||||
static void stop()
|
||||
{
|
||||
if(postgres != null)
|
||||
{
|
||||
postgres.stop();
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Clear the context.
|
||||
*******************************************************************************/
|
||||
@AfterEach
|
||||
void clear()
|
||||
{
|
||||
QContext.clear();
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Declared rows reach the frontend metadata per session; the screen shows a
|
||||
** widget over local data; the app is closed to anyone without its permission;
|
||||
** invalid rows are skipped rather than taking the others down.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
void testDeclaredAppRendersAndIsPermissioned() throws Exception
|
||||
{
|
||||
QInstance instance = instance(RUNTIME, "runtime-synthetic");
|
||||
QContext.init(instance, new QSystemUserSession());
|
||||
seed();
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////////
|
||||
// the customizers created one permission per app and container (URP rows) //
|
||||
/////////////////////////////////////////////////////////////////////////////////
|
||||
assertThat(new CountAction().execute(new CountInput("permission")).getCount()).isGreaterThanOrEqualTo(2);
|
||||
|
||||
var all = new CustomAppsDynamicMetaDataProducer().getCustomAppList(instance, name -> true);
|
||||
assertThat(all.appMap()).containsKey("qcaOperationsBoard");
|
||||
assertThat(all.appMap()).doesNotContainKeys("qcaMissingWidget", "qcaGeneratedName", "qcaNoWidget");
|
||||
assertThat(all.appMap().get("qcaOperationsBoard").getWidgets()).containsExactly(WIDGET);
|
||||
assertThat(all.appMap().get("qcaOperationsBoard").getPermissionRules().getLevel()).isEqualTo(PermissionLevel.HAS_ACCESS_PERMISSION);
|
||||
|
||||
/////////////////////////////////////////////////
|
||||
// a user without the app permission sees none //
|
||||
/////////////////////////////////////////////////
|
||||
QContext.init(instance, new QSession().withPermissions(Set.of("unrelated.read")));
|
||||
var nothing = new MetaDataAction().execute(new MetaDataInput());
|
||||
assertThat(nothing.getApps()).doesNotContainKeys("qcaOperationsBoard", "qcacOperations");
|
||||
assertThat(nothing.getAppTree().stream().map(n -> n.getName())).doesNotContain("qcacOperations");
|
||||
assertThatThrownBy(() -> new RenderWidgetAction().execute(new RenderWidgetInput().withWidgetMetaData(instance.getWidget(WIDGET))))
|
||||
.isInstanceOf(QPermissionDeniedException.class);
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////////
|
||||
// a user granted the app (and its container) sees it and renders real DB data //
|
||||
/////////////////////////////////////////////////////////////////////////////////
|
||||
QContext.init(instance, new QSession().withPermissions(Set.of("qcaOperationsBoard.hasAccess", "qcacOperations.hasAccess", ITEMS + ".read")));
|
||||
var visible = new MetaDataAction().execute(new MetaDataInput());
|
||||
assertThat(visible.getApps()).containsKeys("qcaOperationsBoard", "qcacOperations");
|
||||
assertThat(visible.getWidgets()).containsKey(WIDGET);
|
||||
assertThat(visible.getAppTree().stream().map(n -> n.getName())).contains("qcacOperations");
|
||||
RenderWidgetOutput rendered = new RenderWidgetAction().execute(new RenderWidgetInput().withWidgetMetaData(instance.getWidget(WIDGET)));
|
||||
assertThat(((StatisticsData) rendered.getWidgetData()).getCount()).isEqualTo(3);
|
||||
|
||||
////////////////////////////////////////////////////////////////////////////
|
||||
// a user granted the app but not the container does not see it in the tree //
|
||||
////////////////////////////////////////////////////////////////////////////
|
||||
QContext.init(instance, new QSession().withPermissions(Set.of("qcaOperationsBoard.hasAccess")));
|
||||
assertThat(new MetaDataAction().execute(new MetaDataInput()).getAppTree().stream().map(n -> n.getName())).doesNotContain("qcacOperations");
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** The runtime role does DML only.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
void testRuntimeRoleHasNoDdl() throws Exception
|
||||
{
|
||||
try(Connection runtime = connect(RUNTIME, "runtime-synthetic", "customapps"); Statement statement = runtime.createStatement())
|
||||
{
|
||||
assertThatThrownBy(() -> statement.execute("CREATE TABLE intruder (id int)")).isInstanceOf(SQLException.class).hasMessageContaining("permission denied");
|
||||
assertThatThrownBy(() -> statement.execute("DROP TABLE \"" + CustomApp.TABLE_NAME + "\"")).isInstanceOf(SQLException.class);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Component bundles are code the browser runs: only paths on this application,
|
||||
** or https hosts the configuration lists, are accepted.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
void testComponentSourceIsRestricted() throws Exception
|
||||
{
|
||||
QInstance instance = instance(RUNTIME, "runtime-synthetic");
|
||||
QContext.init(instance, new QSystemUserSession());
|
||||
CustomAppsDynamicMetaDataProducer producer = new CustomAppsDynamicMetaDataProducer();
|
||||
assertThat(producer.isAllowedComponentSource("/dynamic-qfmd-components/q-embed-looker-dashboards.bundle.js")).isTrue();
|
||||
assertThat(producer.isAllowedComponentSource("//evil.example/x.js")).isFalse();
|
||||
assertThat(producer.isAllowedComponentSource("https://evil.example/x.js")).isFalse();
|
||||
assertThat(producer.isAllowedComponentSource("javascript:alert(1)")).isFalse();
|
||||
assertThat(producer.isAllowedComponentSource("data:text/javascript,alert(1)")).isFalse();
|
||||
assertThat(producer.isAllowedComponentSource("/ok/../../etc/passwd")).isFalse();
|
||||
assertThat(producer.isAllowedComponentSource("/a b.js")).isFalse();
|
||||
assertThat(producer.isAllowedComponentSource(null)).isFalse();
|
||||
|
||||
QInstance allowing = instance(RUNTIME, "runtime-synthetic", List.of("Cdn.Example.com"));
|
||||
QContext.init(allowing, new QSystemUserSession());
|
||||
assertThat(producer.isAllowedComponentSource("https://cdn.example.com/x.js")).isTrue();
|
||||
assertThat(producer.isAllowedComponentSource("https://cdn.example.com@evil.example/x.js")).isFalse();
|
||||
assertThat(producer.isAllowedComponentSource("http://cdn.example.com/x.js")).isFalse();
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** The configuration requires its backend.
|
||||
*******************************************************************************/
|
||||
@Test
|
||||
void testConfigValidation() throws Exception
|
||||
{
|
||||
List<String> errors = new java.util.ArrayList<>();
|
||||
new CustomAppsQBitConfig().validate(new QInstance(), errors);
|
||||
assertThat(errors).anyMatch(e -> e.contains("backendName"));
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Synthetic definitions: one valid local-widget app and three invalid ones.
|
||||
*******************************************************************************/
|
||||
private static void seed() throws QException
|
||||
{
|
||||
insert("customAppIcon", new QRecord().withValue("id", 1).withValue("name", "Dashboard").withValue("iconId", "dashboard"));
|
||||
insert("customAppBackendConfig", new QRecord().withValue("id", 1).withValue("name", "Local widget").withValue("customAppBackendId", CustomAppBackendEnum.LOCAL_WIDGET.getId()));
|
||||
insert("customAppContainer", new QRecord().withValue("id", 1).withValue("name", "Operations").withValue("customAppIconId", 1).withValue("sequenceNo", 1));
|
||||
insert("customAppSection", new QRecord().withValue("id", 1).withValue("name", "Boards").withValue("customAppContainerId", 1).withValue("sequenceNo", 1));
|
||||
insertApp(1, "Operations Board", WIDGET);
|
||||
insertApp(2, "Missing Widget", "noSuchWidget");
|
||||
insertApp(3, "Generated Name", "qcaOperationsBoardWidget");
|
||||
insertApp(4, "No Widget", null);
|
||||
for(int i = 1; i <= 3; i++)
|
||||
{
|
||||
insert(ITEMS, new QRecord().withValue("name", "Item " + i));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** One app definition row.
|
||||
*******************************************************************************/
|
||||
private static void insertApp(int id, String name, String widgetName) throws QException
|
||||
{
|
||||
insert("customApp", new QRecord().withValue("id", id).withValue("name", name).withValue("customAppBackendConfigId", 1).withValue("customAppSectionId", 1)
|
||||
.withValue("customAppIconId", 1).withValue("sequenceNo", id).withValue("widgetName", widgetName));
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Insert a record.
|
||||
*******************************************************************************/
|
||||
private static void insert(String table, QRecord record) throws QException
|
||||
{
|
||||
List<QRecord> records = new InsertAction().execute(new InsertInput(table).withRecord(record)).getRecords();
|
||||
assertThat(records.get(0).getErrors()).isEmpty();
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** An application on the given role.
|
||||
*******************************************************************************/
|
||||
private static QInstance instance(String user, String password) throws QException
|
||||
{
|
||||
return instance(user, password, List.of());
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** An application: native PG backend as a role, the roles qbit (whose permission
|
||||
** table the apps use), this qbit with its metadata customizer, a local table and
|
||||
** a permissioned widget over it.
|
||||
*******************************************************************************/
|
||||
private static QInstance instance(String user, String password, List<String> allowedHosts) throws QException
|
||||
{
|
||||
QInstance instance = new QInstance();
|
||||
instance.setEnforcePermissionsInCoreActions(true);
|
||||
instance.withInstanceDefaultAuthentication(new QAuthenticationMetaData().withName("anonymous").withType(QAuthenticationType.FULLY_ANONYMOUS));
|
||||
PostgreSQLBackendMetaData backend = new PostgreSQLBackendMetaData();
|
||||
backend.setName(BACKEND);
|
||||
backend.setHostName(host);
|
||||
backend.setPort(port);
|
||||
backend.setDatabaseName("customapps");
|
||||
backend.setUsername(user);
|
||||
backend.setPassword(password);
|
||||
instance.addBackend(backend);
|
||||
|
||||
new UserRolePermissionsQBitProducer().withUserRolePermissionsQBitConfig(new UserRolePermissionsQBitConfig()
|
||||
.withUserTableConfig(ProvidedOrSuppliedTableConfig.provideTableUsingBackendNamed(BACKEND))
|
||||
.withTableMetaDataCustomizer((i, table) ->
|
||||
{
|
||||
table.setBackendName(BACKEND);
|
||||
return (table);
|
||||
})).produce(instance);
|
||||
new CustomAppsQBitProducer().withQBitConfig(new CustomAppsQBitConfig().withBackendName(BACKEND).withAllowedComponentHosts(allowedHosts)).produce(instance).addSelfToInstance(instance);
|
||||
instance.setMetaDataActionCustomizer(new QCodeReference(CustomAppsMetaDataActionCustomizer.class));
|
||||
|
||||
instance.addTable(new QTableMetaData().withName(ITEMS).withBackendName(BACKEND).withPrimaryKeyField("id")
|
||||
.withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.READ_WRITE_PERMISSIONS).withPermissionBaseName(ITEMS))
|
||||
.withField(new QFieldMetaData("id", QFieldType.INTEGER).withIsEditable(false))
|
||||
.withField(new QFieldMetaData("name", QFieldType.STRING).withMaxLength(100)));
|
||||
instance.addWidget(new QWidgetMetaData().withName(WIDGET).withType(WidgetType.STATISTICS.getType())
|
||||
.withCodeReference(new QCodeReference(ItemCountWidgetRenderer.class))
|
||||
.withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION).withPermissionBaseName("qcaOperationsBoard")));
|
||||
new QInstanceValidator().validate(instance);
|
||||
return instance;
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** A JDBC connection as a named role.
|
||||
*******************************************************************************/
|
||||
private static Connection connect(String user, String password, String database) throws SQLException
|
||||
{
|
||||
return DriverManager.getConnection("jdbc:postgresql://" + host + ":" + port + "/" + database, user, password);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** A widget that counts the rows of the local table, as the viewing user.
|
||||
*******************************************************************************/
|
||||
public static class ItemCountWidgetRenderer extends AbstractWidgetRenderer
|
||||
{
|
||||
/***************************************************************************
|
||||
** Render the count.
|
||||
***************************************************************************/
|
||||
@Override
|
||||
public RenderWidgetOutput render(RenderWidgetInput input) throws QException
|
||||
{
|
||||
Integer count = new CountAction().execute(new CountInput(ITEMS)).getCount();
|
||||
return (new RenderWidgetOutput(new StatisticsData().withCount(count)));
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,87 @@
|
||||
/*
|
||||
* QQQ - Low-code Application Framework for Engineers.
|
||||
* Copyright (C) 2021-2025. Kingsrook, LLC
|
||||
* 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
|
||||
* contact@kingsrook.com
|
||||
* https://github.com/Kingsrook/
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License as
|
||||
* published by the Free Software Foundation, either version 3 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License
|
||||
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package com.kingsrook.qbits.customapps;
|
||||
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
|
||||
import com.kingsrook.qqq.backend.core.model.metadata.tables.UniqueKey;
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** PostgreSQL DDL derived from QQQ table metadata (exact, quoted names, as QQQ
|
||||
** quotes them), so a test schema is exactly what the producer defined.
|
||||
*******************************************************************************/
|
||||
final class TestDdl
|
||||
{
|
||||
/*******************************************************************************
|
||||
** Utility class.
|
||||
*******************************************************************************/
|
||||
private TestDdl()
|
||||
{
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** One CREATE TABLE.
|
||||
*******************************************************************************/
|
||||
static String create(QTableMetaData table)
|
||||
{
|
||||
List<String> lines = new ArrayList<>();
|
||||
for(QFieldMetaData field : table.getFields().values())
|
||||
{
|
||||
lines.add(" \"" + field.getName() + "\" " + type(table, field));
|
||||
}
|
||||
for(UniqueKey key : table.getUniqueKeys() == null ? List.<UniqueKey>of() : table.getUniqueKeys())
|
||||
{
|
||||
lines.add(" UNIQUE (" + String.join(", ", key.getFieldNames().stream().map(n -> "\"" + n + "\"").toList()) + ")");
|
||||
}
|
||||
return "CREATE TABLE \"" + table.getName() + "\" (\n" + String.join(",\n", lines) + "\n)";
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
** Column type and constraints.
|
||||
*******************************************************************************/
|
||||
private static String type(QTableMetaData table, QFieldMetaData field)
|
||||
{
|
||||
if(field.getName().equals(table.getPrimaryKeyField()))
|
||||
{
|
||||
return "INTEGER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY";
|
||||
}
|
||||
String base = switch(field.getType())
|
||||
{
|
||||
case STRING, PASSWORD -> field.getMaxLength() == null ? "TEXT" : "VARCHAR(" + field.getMaxLength() + ")";
|
||||
case TEXT, HTML -> "TEXT";
|
||||
case INTEGER -> "INTEGER";
|
||||
case LONG -> "BIGINT";
|
||||
case BOOLEAN -> "BOOLEAN";
|
||||
case DATE_TIME -> "TIMESTAMP WITH TIME ZONE";
|
||||
default -> throw new IllegalStateException("Unsupported type " + field.getType());
|
||||
};
|
||||
return base + (Boolean.TRUE.equals(field.getIsRequired()) ? " NOT NULL" : "");
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user