83 lines
3.4 KiB
JavaScript
83 lines
3.4 KiB
JavaScript
|
#!/usr/bin/env node
|
||
|
|
/**
|
||
|
|
* Harden the `users` collection and make it usable by the app's
|
||
|
|
* Settings > Users screen.
|
||
|
|
*
|
||
|
|
* Problems found on the live instance:
|
||
|
|
*
|
||
|
|
* 1. createRule was "" (empty string) => PUBLIC. Any anonymous visitor
|
||
|
|
* on the internet could create an account on this PocketBase instance.
|
||
|
|
* 2. listRule was "id = @request.auth.id" => a signed-in member could
|
||
|
|
* only ever see their own record, so there was no way to render a
|
||
|
|
* member list.
|
||
|
|
* 3. The `active` bool field had no default, so every record was created
|
||
|
|
* with active = false. AuthContext refuses to sign in a user whose
|
||
|
|
* `active` is false, so newly created users could not log in at all.
|
||
|
|
* NOTE: PocketBase's REST API strips `defaultValue` from field
|
||
|
|
* definitions (verified on this instance - a scratch collection with
|
||
|
|
* `defaultValue: true` on a bool field still stored false), so the
|
||
|
|
* default cannot be set from here. The app sets `active: true`
|
||
|
|
* explicitly when it creates a member instead.
|
||
|
|
*
|
||
|
|
* New rules (matching the posture already used by every other collection
|
||
|
|
* in this app - stock_items, customers, purchase_orders, quotes, ...):
|
||
|
|
*
|
||
|
|
* listRule @request.auth.id != "" members can list the team
|
||
|
|
* viewRule @request.auth.id != "" members can read a member
|
||
|
|
* createRule @request.auth.id != "" members can add members
|
||
|
|
* updateRule @request.auth.id != "" members can activate/deactivate
|
||
|
|
* deleteRule @request.auth.id != "" members can remove members
|
||
|
|
*
|
||
|
|
* The `role` field is intentionally left untouched: the app does not use
|
||
|
|
* roles, membership is just the `active` flag.
|
||
|
|
*
|
||
|
|
* Usage:
|
||
|
|
* node scripts/fix-users-collection.mjs # dry run (default)
|
||
|
|
* node scripts/fix-users-collection.mjs --apply # apply to the instance
|
||
|
|
*/
|
||
|
|
|
||
|
|
import PocketBase from "pocketbase";
|
||
|
|
|
||
|
|
const PB_URL = process.env.POCKETBASE_URL || "https://pb.jeistk.apphub.co.za";
|
||
|
|
const PB_EMAIL = process.env.POCKETBASE_ADMIN_EMAIL || "david@wfsales.co.za";
|
||
|
|
const PB_PASSWORD = process.env.POCKETBASE_ADMIN_PASSWORD || "1234567890";
|
||
|
|
|
||
|
|
const APPLY = process.argv.includes("--apply");
|
||
|
|
|
||
|
|
const AUTHENTICATED = '@request.auth.id != ""';
|
||
|
|
|
||
|
|
const pb = new PocketBase(PB_URL);
|
||
|
|
pb.autoCancellation(false);
|
||
|
|
|
||
|
|
await pb.admins.authWithPassword(PB_EMAIL, PB_PASSWORD);
|
||
|
|
|
||
|
|
const collection = await pb.collections.getOne("users");
|
||
|
|
|
||
|
|
console.log("=== BEFORE ===");
|
||
|
|
for (const rule of ["listRule", "viewRule", "createRule", "updateRule", "deleteRule"]) {
|
||
|
|
console.log(` ${rule.padEnd(11)}: ${JSON.stringify(collection[rule])}`);
|
||
|
|
}
|
||
|
|
const activeField = collection.fields.find((f) => f.name === "active");
|
||
|
|
console.log(` active field: ${activeField ? "present" : "MISSING"}`);
|
||
|
|
|
||
|
|
if (!APPLY) {
|
||
|
|
console.log("\nDry run. Re-run with --apply to write these rules to the instance.");
|
||
|
|
process.exit(0);
|
||
|
|
}
|
||
|
|
|
||
|
|
collection.listRule = AUTHENTICATED;
|
||
|
|
collection.viewRule = AUTHENTICATED;
|
||
|
|
collection.createRule = AUTHENTICATED;
|
||
|
|
collection.updateRule = AUTHENTICATED;
|
||
|
|
collection.deleteRule = AUTHENTICATED;
|
||
|
|
|
||
|
|
const updated = await pb.collections.update(collection.id, collection);
|
||
|
|
|
||
|
|
console.log("\n=== AFTER ===");
|
||
|
|
for (const rule of ["listRule", "viewRule", "createRule", "updateRule", "deleteRule"]) {
|
||
|
|
console.log(` ${rule.padEnd(11)}: ${JSON.stringify(updated[rule])}`);
|
||
|
|
}
|
||
|
|
|
||
|
|
console.log("\nDone. Existing records keep their current `active` value - flip them");
|
||
|
|
console.log("from Settings > Users if they should be able to sign in.");
|